I am using hibernate on the server side with a client application started via Java Web Start. I can't sign the jars (I'd like to but I can't). I get a permission exception when I get a POJO with lazy fields. Caused by: java.security.AccessControlException: access denied (java.util.PropertyPermission cglib.debugLocation read) at java.security.AccessControlContext.checkPermission(Unknown Source) at java.security.AccessController.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPropertyAccess(Unknown Source) at java.lang.System.getProperty(Unknown Source) at net.sf.cglib.core.DebuggingClassWriter.(DebuggingClassWriter.java:35) ... 44 more How can I avoid that? I thought about setting the collection to null before returning the pojo to the client but I'd like to find a better solution.