diff --git a/core/src/main/java/hudson/DescriptorExtensionList.java b/core/src/main/java/hudson/DescriptorExtensionList.java
index 1e2c3eb8c1..50bcd0cbe9 100644
--- a/core/src/main/java/hudson/DescriptorExtensionList.java
+++ b/core/src/main/java/hudson/DescriptorExtensionList.java
@@ -26,6 +26,7 @@ package hudson;
 import hudson.model.Descriptor;
 import hudson.model.Describable;
 import hudson.model.Hudson;
+import hudson.model.Descriptor.FormException;
 import hudson.util.Memoizer;
 
 import java.util.List;
@@ -36,6 +37,8 @@ import java.lang.reflect.Type;
 import java.lang.reflect.ParameterizedType;
 
 import org.jvnet.tiger_types.Types;
+import org.kohsuke.stapler.Stapler;
+import net.sf.json.JSONObject;
 
 /**
  * {@link ExtensionList} for holding a set of {@link Descriptor}s, which is a group of descriptors for
@@ -66,6 +69,22 @@ public final class DescriptorExtensionList<T extends Describable<T>> extends Ext
         return Descriptor.find(this,fqcn);
     }
 
+    /**
+     * Creates a new instance of a {@link Describable}
+     * from the structured form submission data posted
+     * by a radio button group.
+     */
+    public T newInstanceFromRadioList(JSONObject config) throws FormException {
+        if(config.isNullObject())
+            return null;    // none was selected
+        int idx = config.getInt("value");
+        return get(idx).newInstance(Stapler.getCurrentRequest(),config);
+    }
+
+    public T newInstanceFromRadioList(JSONObject parent, String name) throws FormException {
+        return newInstanceFromRadioList(parent.getJSONObject(name));
+    }
+
     /**
      * Loading the descriptors in this case means filtering the descriptor from the master {@link ExtensionList}.
      */
diff --git a/core/src/main/java/hudson/Functions.java b/core/src/main/java/hudson/Functions.java
index 20be58a2f1..dd659ea239 100644
--- a/core/src/main/java/hudson/Functions.java
+++ b/core/src/main/java/hudson/Functions.java
@@ -597,7 +597,7 @@ public class Functions {
     }
 
     public static List<Descriptor<AuthorizationStrategy>> getAuthorizationStrategyDescriptors() {
-        return AuthorizationStrategy.LIST;
+        return AuthorizationStrategy.all();
     }
 
     public static List<Descriptor<Builder>> getBuilderDescriptors(AbstractProject<?,?> project) {
diff --git a/core/src/main/java/hudson/model/Hudson.java b/core/src/main/java/hudson/model/Hudson.java
index d9b4cdf6ea..36a7c1f692 100644
--- a/core/src/main/java/hudson/model/Hudson.java
+++ b/core/src/main/java/hudson/model/Hudson.java
@@ -1966,7 +1966,7 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
                 useSecurity = true;
                 JSONObject security = json.getJSONObject("use_security");
                 setSecurityRealm(SecurityRealm.LIST.newInstanceFromRadioList(security,"realm"));
-                setAuthorizationStrategy(AuthorizationStrategy.LIST.newInstanceFromRadioList(security, "authorization"));
+                setAuthorizationStrategy(AuthorizationStrategy.all().newInstanceFromRadioList(security, "authorization"));
             } else {
                 useSecurity = null;
                 setSecurityRealm(SecurityRealm.NO_AUTHENTICATION);
diff --git a/core/src/main/java/hudson/security/AuthorizationStrategy.java b/core/src/main/java/hudson/security/AuthorizationStrategy.java
index 3174e6e544..b49eba8e62 100644
--- a/core/src/main/java/hudson/security/AuthorizationStrategy.java
+++ b/core/src/main/java/hudson/security/AuthorizationStrategy.java
@@ -25,7 +25,9 @@ package hudson.security;
 
 import hudson.ExtensionPoint;
 import hudson.Extension;
+import hudson.DescriptorExtensionList;
 import hudson.slaves.Cloud;
+import hudson.slaves.RetentionStrategy;
 import hudson.model.AbstractItem;
 import hudson.model.Computer;
 import hudson.model.Describable;
@@ -174,17 +176,30 @@ public abstract class AuthorizationStrategy implements Describable<Authorization
     public abstract Collection<String> getGroups();
 
     public Descriptor<AuthorizationStrategy> getDescriptor() {
-        return Hudson.getInstance().getDescriptor(getClass()); 
+        return Hudson.getInstance().getDescriptor(getClass());
+    }
+
+    /**
+     * Returns all the registered {@link AuthorizationStrategy} descriptors.
+     */
+    public static DescriptorExtensionList<AuthorizationStrategy> all() {
+        return Hudson.getInstance().getDescriptorList(AuthorizationStrategy.class);
     }
 
     /**
      * All registered {@link SecurityRealm} implementations.
+     *
+     * @deprecated
+     *      Use {@link #all()} for read access, and {@link Extension} for registration.
      */
     public static final DescriptorList<AuthorizationStrategy> LIST = new DescriptorList<AuthorizationStrategy>(AuthorizationStrategy.class);
     
     /**
      * {@link AuthorizationStrategy} that implements the semantics
      * of unsecured Hudson where everyone has full control.
+     *
+     * <p>
+     * This singleton is safe because {@link Unsecured} is stateless.
      */
     public static final AuthorizationStrategy UNSECURED = new Unsecured();