In this example, basic security services (principal identification and authentication, secure communication channel) are provided by an object that implements the SecurityService interface. Because a generic remote object must not be dependent on a particular kind of security service, it must take a reference to this object as a parameter to its constructor. This is exactly what happens here, where the reference to the object is stored in a dedicated private field:
private SecurityService security ;
The SecurityService interface is part of the extended application development framework and offers an API that can then be used to check on the current security status.