This thread is helpful for my current problem, but I'm not sure how to interpret this table: Object RoleA RoleB Unchecked | Page1 view view -none- | Portlet1 view -none- -none- | Portlet2 view -none- -none- | Portlet3 -none- view -none- | Portlet4 -none- view -none- Re: "-none-", do I include a policy permission that doesn't have an action-name? Do make the action-name '-none-", or do I simply not include the policy permission at all? I am trying to add security contraints to my pages, but so far I haven't been able to deny my self any instances or pages - I can still see everything. /portal 2.4.1 and AS 4.0.5 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4033791#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...