Major Description
SecurityProviderImpl has dynamic references to many other services, like RestrictionProvider, that represent the configuration of this component.
Being these services dynamic, the OSGi runtime has no clear dependency relationship between the SecurityProviderImpl and the required services. Thus, it may happen that an instance of SecurityProviderImpl is published before the services it requires are started, creating a window where the SecurityProviderimpl is operating differently from the way it's configured.
I suggest to turn the dynamic references in SecurityProviderImpl to static ones to improve the consistency of the implementation.