> Could you swap your two memberships then run the tests again? > I the above theory is correct then both racc1 and edge1 will > allow any "show" commands. Another test: what happens if you omit "return .*" lines from ACL-s? Gabor