There are several related issues ;
- injected fields : when the field is accessed a SecutityException is thrown (which is right), but is not properly handled, and it should be transparent to the user
- callbacks : when callbacks are invoked the service object is get with APAM privileges and passed
to the source component, violating the service permission
- relations are allowed to all apamized OSGi services, irrespective of service permissions
The best solution is verifying service permissions before creating links.