BTW Nico MIT already has configurable delegation policy, similar to AD. Of course it could be more flexible. -- Luke