I suggest you enable ACL logging. It will tell you exactly which to and by clauses are being applied (or not). Kurt