Robert Lemke wrote: Hi, > acls: > SomeRole: > controllersInGeneral: GRANT > certainSpecialControllers: DENYIF(...) I would really separate the two words by an underscore GRANTIF and DENYIF looks really cryptical ;) Bastian