I'm using RMI to invoke a method that is specified to return an object of class ClassX.

ClassX xObj = remoteObject.meth(...); 

If the remote method actually returns an instance of a locally unknown subclass SubclassOfX of ClassX, this class SubclassOfX is automatically downloaded from a codebase (as specified by the annotation on the serialized instance of SubclassOfX).
(for those who need it: codebase concept in RMI)

Before Java17, a SecurityManager (and a policy file) had to be used to allow class loading from the codebase. But starting with Java17, the SecurityManager is deprecated and marked for removal.

My question now: how to allow/control class loading from a codebase in the future?

Edit1: And just to answer to comment citing jep411: I know about this document, but there is no solution/alternative given in it for this RMI use case of SecurityManager.