<pre><code>grant {
    permission java.security.AllPermission;
};
</code></pre>

<p>This works.</p>

<pre><code>grant file:///- {
    permission java.security.AllPermission;
};
</code></pre>

<p>This does not work.  Could someone please explain to me why?</p>

The directive "grant { permission }" means grant the permission to all code no matter where it came from. In other words, when there is no codebase specified, the code could be loaded from the network or the file system.
The second directive (if it worked) would only apply to the local file system. It would be specifying all files (recursively) on the local file system. I'm not sure that "file:///" is a valid URL by itself. I know that
```
file:///tmp/-
```
works.