From an e-mail discussion:
... Derby should match the security provided by typical client server systems such as DB2, Oracle, etc. I
think in this case system/database owners are trusting the database
system to ensure that their system cannot be attacked. So maybe if Derby
is booted as a standalone server with no security manager involved, it
should install one with a default security policy. Thus allowing Derby
to use Java security manager to manage system privileges but not
requiring everyone to become familiar with them.
I imagine such a policy would allow any access to databases under derby.system.home and/or user.home.
By standalone I mean the network server was started though the main() method (command line).