> Actually, what happens is that the Finder still has permission from 
> Authorisation Services to do things, so it doesn't need to 
> re-authenticate with the user until the permission expires. And it 
> gets issued with a default set of rights rather than a more 
> restrictive set. This doesn't imply that every application (ie the 
> viruses or startup items) have the necessary authorisations.

Thanks Shay, that sounds more like it.

If BBEdit isn't inheriting authorisation somehow, then the
question remains of how BBEdit can alter files that it just
shouldn't be able to. Admittedly I only used it as a simple
test, but I didn't think it could do anything that any other
program can't.

Ryan