Could someone please verify the intent and meaning of "AA Instance" relative to web services.... Pete and I were drafting some content for the security section and ended up in a discussion on how to enforce different security policies for different AA Instances. This might also pertain to transport protocols as well since some transports are more secure than others and that might be specified somehow in the security policy. ACS currently returns an EPR (or WS-Name perhaps) as a result of a create operation. That EPR could technically be anywhere on the network, although most likely it would be on the same box as the ACS service. Is it expected that each AA Instance is a separate web service or would it be a part of and managed by the ACS Web Service? The question delves into the implementation architecture and the answer might impact the way the specification is written with regard to requirements. -- Michael Behrens R2AD, LLC (571) 594-3008 (cell) *new* (703) 714-0442 (land)