This article about Java security says:
Code in the Java library consults the Security Manager whenever a dangerous operation is about to be attempted.
The security manager uses a policy file to see what is permitted and what's not permitted. "Dangerous" operations, as determined by this policy file, is granted or denied during the execution.
You can find more details about the default policy for Sun/Oracle JVM here:
http://download.oracle.com/javase/6/docs/technotes/guides/security/PolicyFiles.html