This should work. It's probably easier to simply reject edits which are trying to mess your ACLs; then you don't have to parse/fix things too much.How to reject edits in the preSave method?
Throw a RedirectException(). Check out the SpamFilter for an example. /Janne
