I'm using the the instance based ACL security of Acegi (0.7 snapshot from cvs). This is truly impressive piece of work (easily beats every home grown equivalents we've done :). Ben, would it be feasible to add support to filter arrays too in BasicAclEntryAfterInvocationCollectionFilteringPro vider? Many of our service layer methods always returns type safe arrays instead of collections (this will change when we move on to Java 5).
Sure, and indeed you could probably refactor the core code into an abstract parent shared by the Collection and Array-based filtering providers. I'd be more than happy to add this as a contribution. Arrays are actually a bit easier, as you don't have to preserve the underlaying Collection concrete object.