BCFIPS Approved Mode default value clarification

Hi folk, 

Reading through [1] and [2], I get the impression that when a JVM is running with Security Manager enabled and no permission has been explicitly set for unapprovedModeEnabled, all threads should start with approved only mode. 

More specifically [1] mentions:

"If the underlying JVM is running with a Java Security Manager installed the module will
be running in approved mode with secret and private key export disabled."

and [2] mentions:

"CryptoServicesRegistrar calculates the default mode of operation based on the granting of permission    org.bouncycastle.crypto.CryptoServicesPermission “unapprovedModeEnabled”; 
If this permission is granted by the security manager, then the JVM will start threads in a default of unapproved mode. If this permission is not granted by the security manager, then the JVM will start threads in the approved mode only." 

My test setup is openjdk-8 with only 
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider

enabled, and a vanilla java.policy file ( which doesn't contain  any grants for org.bouncycastle.crypto.CryptoServicesPermission “unapprovedModeEnabled”; ) .


Running the following with security manager enabled

import org.bouncycastle.crypto.CryptoServicesRegistrar;
import java.security.Provider;
import java.security.Security;

public class Main {

    public static void main(String[] args) {
        if (null != System.getSecurityManager()){
            System.out.println("Running with security manager");
        }
        Provider[] providers = Security.getProviders();
        for (Provider p: providers){
            System.out.println("Enabled Security Provider: "+p.getName());
        }
        System.out.println("Is in approved only mode: "+CryptoServicesRegistrar.isInApprovedOnlyMode());
        CryptoServicesRegistrar.setApprovedOnlyMode(true);
        System.out.println("Is in approved only mode: "+CryptoServicesRegistrar.isInApprovedOnlyMode());
    }
}


I get 

Running with security manager
Enabled Security Provider: BCFIPS
Is in approved only mode: false
Is in approved only mode: true


This seems to indicate that JVM starts with unapproved mode allowed, and I need to explicitly set it to approved only mode with CryptoServicesRegistrar.setApprovedOnlyMode(true);


Is there an issue with the test setup or with my understanding of the default value of approved only mode ?  


Best Regards
Ioannis


[1]https://bouncycastle.org/fips/BCSecurityPolicy.pdf - Section 1.2
[2] https://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.0.pdf Appendix B 2.1


​​