--- a/src/java.base/share/classes/javax/security/auth/Policy.java	Fri Oct 27 08:32:45 2017 +0000
+++ b/src/java.base/share/classes/javax/security/auth/Policy.java	Fri Oct 27 21:10:56 2017 +0800
@@ -134,7 +134,7 @@
  * setting the value of the {@code auth.policy.provider} security property to
  * the fully qualified name of the desired {@code Policy} implementation class.
  *
- * @deprecated  as of JDK version 1.4 -- Replaced by java.security.Policy.
+ * @deprecated  Replaced by java.security.Policy.
  *              java.security.Policy has a method:
  * <pre>
  *      public PermissionCollection getPermissions
@@ -152,11 +152,12 @@
  *
  * These two APIs provide callers the means to query the
  * Policy for Principal-based Permission entries.
+ * This class is subject to removal in a future version of Java SE.
  *
  * @since 1.4
  * @see java.security.Security security properties
  */
-@Deprecated(since="1.4")
+@Deprecated(since="1.4", forRemoval=true)
 public abstract class Policy {
 
     private static Policy policy;

--- a/src/java.base/share/classes/javax/security/auth/SubjectDomainCombiner.java	Fri Oct 27 08:32:45 2017 +0000
+++ b/src/java.base/share/classes/javax/security/auth/SubjectDomainCombiner.java	Fri Oct 27 21:10:56 2017 +0800
@@ -29,7 +29,6 @@
 import java.security.Permission;
 import java.security.Permissions;
 import java.security.PermissionCollection;
-import java.security.Policy;
 import java.security.Principal;
 import java.security.PrivilegedAction;
 import java.security.ProtectionDomain;
@@ -57,7 +56,7 @@
         sun.security.util.Debug.getInstance("combiner",
                                         "\t[SubjectDomainCombiner]");
 
-    @SuppressWarnings("deprecation")
+    @SuppressWarnings({"deprecation", "removal"})
     // Note: check only at classloading time, not dynamically during combine()
     private static final boolean useJavaxPolicy =
         javax.security.auth.Policy.isCustomPolicySet(debug);
@@ -303,7 +302,7 @@
         if (!allowCaching) {
             java.security.AccessController.doPrivileged
                 (new PrivilegedAction<Void>() {
-                    @SuppressWarnings("deprecation")
+                    @SuppressWarnings({"deprecation", "removal"})
                     public Void run() {
                         // Call refresh only caching is disallowed
                         javax.security.auth.Policy.getPolicy().refresh();
@@ -374,7 +373,7 @@
                         PermissionCollection newPerms =
                             java.security.AccessController.doPrivileged
                             (new PrivilegedAction<PermissionCollection>() {
-                            @SuppressWarnings("deprecation")
+                            @SuppressWarnings({"deprecation", "removal"})
                             public PermissionCollection run() {
                                 return
                                     javax.security.auth.Policy.getPolicy().getPermissions

--- a/src/java.base/share/classes/sun/security/provider/AuthPolicyFile.java	Fri Oct 27 08:32:45 2017 +0000
+++ b/src/java.base/share/classes/sun/security/provider/AuthPolicyFile.java	Fri Oct 27 21:10:56 2017 +0800
@@ -65,6 +65,7 @@
  *             This class is entirely deprecated.
  */
 @Deprecated
+@SuppressWarnings("removal")
 public class AuthPolicyFile extends javax.security.auth.Policy {
 
     static final ResourceBundle rb =