grant {
  // required by Jackson/Gson to (se)deserializing checkpoints
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
  permission java.lang.RuntimePermission "accessDeclaredMembers";
  permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
  permission java.net.SocketPermission "*", "connect,resolve";
  // required for GenericObjectPool in CheckpointDao
  permission javax.management.MBeanServerPermission "createMBeanServer";
  permission javax.management.MBeanPermission "org.apache.commons.pool2.impl.GenericObjectPool#-[org.apache.commons.pool2:name=pool,type=GenericObjectPool]", "registerMBean";
  permission javax.management.MBeanPermission "org.apache.commons.pool2.impl.GenericObjectPool#-[org.apache.commons.pool2:name=pool,type=GenericObjectPool]", "unregisterMBean";
  permission javax.management.MBeanTrustPermission "register";
  permission java.lang.RuntimePermission "getClassLoader";
  permission java.lang.RuntimePermission "setContextClassLoader";
};