Request security manager on specific object?

[Jeramie Hicks]

I'm writing a Java application that would allow for third-party modules to extend it. I'd like to enforce a requirement that the third-party modules are not able to access the local disk or network - they're only able to call methods from my main application API. Is that possible?

Note my main application needs to access the local disk and network, just not the extension modules. I don't want somebody sneaking in something they shouldn't in an extension module.