Just curious about how jaxb works, I have a class annotated as follows:
@XmlRootElement(name = \"MyJaxb\")
Class MyJaxb
{
@XmlElement
protected S
Beyond answer that reflection can by-pass checks (which is correct), this is also something that other JDK internal parts need, specifically default Object serialization and deserialization. In general this is allowed because many tools benefit from such access. And like others have correctly pointed out, access rights are not meant as real security barriers. They are there to help programmers design abstractions properly, make it easier to come up with good designs.