Hi, I am fairly new to the java security topic. Please point me some directions for the problem I have. Is it possible to use JAAS to control the instantiation of a certain user defined class objects? For example, I have a set of request event classes (these are pure simple Java classes) that are resides in com.mycom.event.request.type1 and com.mycom.event.request.type2 ..., I want to set up a policy such that a certain Subjects (users) can only instantiate request objects in package "type1" and other Subjects can only create request objects in package "type2". If possible, could someone show how to do it? what kind of permission should I grant to these users? Thanks, David    More>>