These definitions comprise the HealthFrameWorks security policy objects. A user name is something like Jim, or fred@RecordsForLiving.com. It can be basically any string the user chooses to uniquely identify himself. It does NOT need to be forever unique. UserNames are mapped to UserIDType, and the UserIDType is what is stored with objects to identify them. A UserIDType is a GUID (need to refine this 'restriction' to be a GUID). A 'security principal' - SecurityPrincipalType - can be either a username, or a user-id. It is something recognized as uniquely describing a person or group to which permission specifications apply. The form of a user-id is a GUID. This is what is stored internally. But the username (e.g. fred@yahoo.com) can be any string. The way this is disambugiated (conceptually, not necesarily in the implementation), is that a name security principal is looked up in the user database, and mapped to a GUID. If its not found, but is already found to be in the form of a guid, its assumed it was really just a guid to begin with. Plus - there is the special SecurityPrincipalType - kWildcardPrincipal (*). This type SHOULD be redine to be a UNION of UserNameType, UserIDType, and some specials (like *). This defines the type of access an access control rule applies to. The values Read Write ReadMetaInfo WriteMetaInfo Delete Restore ReadSecurity WriteSecurity all define elemental types which can be combined by listing multiple AccessType elements. The value Full refers to all of the above permissions. This is to describe the kind of object to which an ACL (access control list) applies. An ACL always refers to an implied HR (often the one its stored with). The ACL can also apply either to an elmenet within that HR (such as a condition, or filter), or it can refer to a report. Which - is determined by the ReportID/RelativeID attributes. Note - we cannot use IDREF for RelativeID because this schema element (ACLs) could be stored separately from the HR to which it applies Use NONE for an unencoded password and primary for the default password encoding. Note - either one COULD fail - if unsupported. Use Primary to get/set the password in the form which is the native/default format for the given repository. Use this enumeration value if you dont need to know the format - just to 'pass though' an encoded password.