Jim,

>No you would not need to change the security_manager at all, data drive it for what classes to use for which requests and all you ned to do is provide a new class with the new behavior. Use a factory pattern so that the security_manager constructs its insides on the fly, that is it creates the internal objects when they are needed and passes requests on to them.

What if a new security object provides new methods and properties which should be accessed through the security manager ?

Walter,