@Override
  public AttributeList setAttributes(ObjectName name, AttributeList attributes)
      throws InstanceNotFoundException, ReflectionException {
    // call setAttribute instead to use the authorization logic
    checkAuthorization(name,
        (String[]) attributes.parallelStream().map(attribute -> ((Attribute) attribute).getName())
            .toArray());
    try {
      mbs.setAttributes(name, attributes);
    } catch (Exception e) {
      throw new GemFireSecurityException("error setting attributes :" + attributes + " of " + name,
          e);
    }
    return attributes;
  }
This class intercepts all MBean requests for GemFire MBeans and passed it to
ManagementInterceptor for authorization

@since Geode 1.0
geode-core/src/main/java/org/apache/geode/management/internal/security/MBeanServerWrapper.java