Working on the Grant/Revoke rights of RTx-RightsMatrix, I have found that after revoking SuperUser from a principal, all calls to HasRight shortly after return true. I see 2 options: 1. Have RevokeRight invalidate the ACL cache. 2. Add an option to HasRight that ignores the cache. Are there other options? Thanks. -Todd