@Test
  @ConnectionConfiguration(user = "stranger", password = "1234567")
  public void testQueryBean() throws MalformedObjectNameException, IOException {
    MBeanServerConnection con = connectionRule.getMBeanServerConnection();
    Set<ObjectInstance> objects =
        con.queryMBeans(ObjectName.getInstance(ResourceConstants.OBJECT_NAME_ACCESSCONTROL), null);
    assertThat(objects.size()).isEqualTo(0); // no AccessControlMBean in the query result

    objects = con.queryMBeans(ObjectName.getInstance("GemFire:service=CacheServer,*"), null);
    assertThat(objects.size()).isEqualTo(1);
  }
looks like everyone can query for beans, but the AccessControlMXBean is filtered from the
result
geode-core/src/integrationTest/java/org/apache/geode/management/internal/security/MBeanSecurityJUnitTest.java