I've also tried adding the following to the *-object.xml that is used to configure the portal. With the overwrite option set. However it doesn't seem to make any difference. I'm not sure one can associate a security-constraint with the window... seems like I saw a note about that somewhere. <window> | <window-name>VacationBalance</window-name> | <instance-ref>VacationFlex</instance-ref> | <region>left</region> | <height>1</height> | <security-constraint> | <policy-permission> | <role-name>employees</role-name> | <action-name>view</action-name> | </policy-permission> | </security-constraint> | </window> | | View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4124597#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...