What is the parent delegation model in Java class loading, and why is it important for security and consistency?

The parent delegation model means a class loader, before attempting to load a class itself, first delegates the request up to its parent loader (bootstrap being the ultimate root), only attempting to load the class itself if none of its ancestors could find it -- this ensures core JDK classes (like java.lang.String) are always loaded by the trusted bootstrap loader regardless of what's on the application classpath, preventing a malicious or accidental application-level String.class from ever shadowing/replacing the genuine JDK implementation, since delegation always checks upward first.

// Simplified conceptual illustration of delegation
public class MyClassLoader extends ClassLoader {
    @Override
    protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
        // Default ClassLoader.loadClass() already implements delegation:
        // 1. Check if already loaded
        // 2. Delegate to parent first
        // 3. Only if parent fails, attempt findClass() locally
        return super.loadClass(name, resolve);
    }
}