This is more a FYI than a request to start discussing the document but as I am reviewing the requirements and having discussions either on this list or on the PicketBox forums I am starting to collect together the details regarding domain management security in the following document: - http://community.jboss.org/wiki/ManagementAPISecurityDesign Regards, Darran Lofthouse.