Hi, It seems Rule Agent does not check does not provide credential to get last modified time for a snpashot of a package and also on Guvnor side no security check is provided when last modified time is retreived for the snapshot of respective package. Relevant security check is only provided when agent downloads the snapshot. I do not know why it is so, but security check is provided for any request of resource to the server. Thanks, V