Looking at this discussion, looks like two efforts are being proposed. 1/ A re-usable POJO ACL layer across JEMS (topic of this discussion, and IMO a higher priority item) 2/ A re-usable Identity Management Framework across JEMS (IMO, a nice to have, but not too urgent, especially considering the agreements that all JEMS projects will have to come to, in order to decide it) I think ACL layer Design/Implementation should not be bogged down by the slower paced Identity Framework Design. They should be independent components of each other. Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4098488#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...