In my lunch-time browsing, I stumbled over "let group principals have deny entries again" in http://svn.apache.org/viewvc?view=rev&revision=801594 . Testing the code is scheduled for tomorrow's lunch break, but if it is what it sounds like, I'm as happy as Ian to see it in Jackrabbit 2.0.
Just a note to all the others that also missed the change... Marc
