Scott, I think we will need a custom policy post AS5GA to correctly get all the use cases, VFS has. At the moment, the criticality is that we have something like 100-200 tests currently disabled in the test suite because the AS cannot run under a security manager. I did try out the jar url format (which of course turned out to be stupid) that could do nested wars in ears etc. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4188563#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...