Could it be that the SecurityManager itself doesn't have the required permissions?
By being sandwiched into the call-stack between the privileged code, and the AccessController generates a privilege union of none?