Dear EG, Has any consideration been given to the inclusion of permissions into module-info files, perhaps in a future release of the JPMS? From a sandboxing perspective it would be nice if the set of permissions a module might need could be enumerated by the developers themselves, rather than sandbox builders having to discover the set by trial and error or exhaustively reading the code of their dependencies. If JPMS 1.0 will understandably not ship with such a feature, is the module-info.class file format sufficiently extensible that such things could be added in future, e.g. module foo.bar { require ...; permissions { require java.net.SocketPermission .... } } (with a missing permissions block being equal to all permissions).