Java software components may be signed. The CodeSource associated with a component (i.e., one or more related classes) includes a set of signers recording the principals who developed that piece of code, or those who authorize the validity of the code. In the current Java model, a CodeSource encapsulates a set of signers who signed the class files, and the URL representing the location from which those class files are to be downloaded. Access can then be controlled based on such a CodeSource.