This week's book giveaway is in the OCMJEA forum. We're giving away four copies of OCM Java EE 6 Enterprise Architect Exam Guide and have Paul Allen & Joseph Bambara on-line! See this thread for details.
In order to access the file system (for read or for writes does not matter) without the JWS Services you need to ask for full permissions when starting the application. You can do that by adding <all-permissions/> to the security section of your JNLP file (note, however, that your classes have to be signed for this).
Unfortunately, there is no finer-grained security concept for Java Webstart. You can either have no permission at all, forcing you to use the services for everything, or request all permissions even if you don't really need them.