So, what to do about scope and client templates? Client templates could have "full scope allowed" or define a scope. A client would either click "full scope allowed" or it can add additional scoped roles. Sound ok? -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com