[417474] [Security] Factor out PermissionFilters to separate access

level from filter application 
https://bugs.eclipse.org/bugs/show_bug.cgi?id=417474

83 files changed, 7432 insertions, 376 deletions

diff --git a/plugins/org.eclipse.emf.cdo.security.edit/META-INF/MANIFEST.MF b/plugins/org.eclipse.emf.cdo.security.edit/META-INF/MANIFEST.MF
index 54b97584ae..29d0bc6029 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/META-INF/MANIFEST.MF
+++ b/plugins/org.eclipse.emf.cdo.security.edit/META-INF/MANIFEST.MF
@@ -2,14 +2,14 @@ Manifest-Version: 1.0
 Bundle-ManifestVersion: 2
 Bundle-Name: %pluginName
 Bundle-SymbolicName: org.eclipse.emf.cdo.security.edit;singleton:=true
-Bundle-Version: 4.2.0.qualifier
+Bundle-Version: 4.3.0.qualifier
 Bundle-ClassPath: .
 Bundle-Activator: org.eclipse.emf.cdo.security.provider.SecurityEditPlugin$Implementation
 Bundle-Vendor: %providerName
 Bundle-Localization: plugin
 Bundle-RequiredExecutionEnvironment: J2SE-1.5
-Export-Package: org.eclipse.emf.cdo.security.provider;version="4.2.0"
-Require-Bundle: org.eclipse.core.runtime;bundle-version="[3.5.0,4.0.0)",
+Export-Package: org.eclipse.emf.cdo.security.provider;version="4.3.0"
+Require-Bundle: org.eclipse.emf.cdo.edit;bundle-version="[4.1.0,5.0.0)";visibility:=reexport,
  org.eclipse.emf.cdo.security;bundle-version="[4.1.0,5.0.0)";visibility:=reexport,
- org.eclipse.emf.cdo.edit;bundle-version="[4.1.0,5.0.0)";visibility:=reexport
+ org.eclipse.emf.cdo.expressions.edit;bundle-version="[4.3.0,5.0.0)";visibility:=reexport
 Bundle-ActivationPolicy: lazy
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/AndFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/AndFilter.gif
new file mode 100644
index 0000000000..a128413d88
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/AndFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ClassFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ClassFilter.gif
new file mode 100644
index 0000000000..2b8da630d8
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ClassFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ExpressionFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ExpressionFilter.gif
new file mode 100644
index 0000000000..4c5d117d5d
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ExpressionFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/FilterPermission.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/FilterPermission.gif
new file mode 100644
index 0000000000..a5317bd79c
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/FilterPermission.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/LinkedFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/LinkedFilter.gif
new file mode 100644
index 0000000000..ca8d8a3d90
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/LinkedFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/NotFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/NotFilter.gif
new file mode 100644
index 0000000000..0d5ee8999e
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/NotFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/OrFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/OrFilter.gif
new file mode 100644
index 0000000000..61a7b1d995
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/OrFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/PackageFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/PackageFilter.gif
new file mode 100644
index 0000000000..30c5c10cc4
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/PackageFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourceFilter.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourceFilter.gif
new file mode 100644
index 0000000000..061161ae1c
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourceFilter.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourcePermission.gif b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourcePermission.gif
index 27c7cbbe48..061161ae1c 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourcePermission.gif
+++ b/plugins/org.eclipse.emf.cdo.security.edit/icons/full/obj16/ResourcePermission.gif
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/plugin.properties b/plugins/org.eclipse.emf.cdo.security.edit/plugin.properties
index ba9e04af11..2335720fa2 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/plugin.properties
+++ b/plugins/org.eclipse.emf.cdo.security.edit/plugin.properties
@@ -91,3 +91,45 @@ _UI_Realm_defaultUserDirectory_feature = Default User Directory
 _UI_Realm_defaultGroupDirectory_feature = Default Group Directory
 _UI_Realm_defaultRoleDirectory_feature = Default Role Directory
 _UI_ObjectPermission_type = Object Permission
+_UI_ExpressionPermission_type = Expression Permission
+_UI_ExpressionPermission_expression_feature = Expression
+_UI_LogicalPermission_type = Logical Permission
+_UI_LogicalPermission_operator_feature = Operator
+_UI_LogicalPermission_operands_feature = Operands
+_UI_LogicalOperator_Not_literal = Not
+_UI_LogicalOperator_And_literal = And
+_UI_LogicalOperator_Or_literal = Or
+_UI_FilterPermission_type = Filter Permission
+_UI_PermissionFilter_type = Permission Filter
+_UI_PackageFilter_type = Package Filter
+_UI_ClassFilter_type = Class Filter
+_UI_ResourceFilter_type = Resource Filter
+_UI_ObjectFilter_type = Object Filter
+_UI_ExpressionFilter_type = Expression Filter
+_UI_CombinedFilter_type = Combined Filter
+_UI_NotFilter_type = Not Filter
+_UI_AndFilter_type = And Filter
+_UI_OrFilter_type = Or Filter
+_UI_FilterPermission_filter_feature = Filter
+_UI_PackageFilter_applicablePackage_feature = Applicable Package
+_UI_ClassFilter_applicableClass_feature = Applicable Class
+_UI_ResourceFilter_pattern_feature = Pattern
+_UI_ExpressionFilter_expression_feature = Expression
+_UI_CombinedFilter_operands_feature = Operands
+_UI_ReferenceFilter_type = Reference Filter
+_UI_ReferenceFilter_reference_feature = Reference
+_UI_FilterPermission_filters_feature = Filters
+_UI_ClassFilter_subTypes_feature = Sub Types
+_UI_ResourceFilter_readParents_feature = Read Parents
+_UI_LinkedFilter_type = Linked Filter
+_UI_LinkedFilter_filter_feature = Filter
+_UI_ResourceFilter_inclusion_feature = Inclusion
+_UI_Inclusion_None_literal = None
+_UI_Inclusion_Up_literal = Up
+_UI_Inclusion_Down_literal = Down
+_UI_Inclusion_Pattern_literal = Pattern
+_UI_ResourceFilter_path_feature = Path
+_UI_Inclusion_Exact_literal = Exact
+_UI_Inclusion_ExactAndUp_literal = ExactAndUp
+_UI_Inclusion_ExactAndDown_literal = ExactAndDown
+_UI_Inclusion_Regex_literal = Regex
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/AndFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/AndFilterItemProvider.java
new file mode 100644
index 0000000000..a415f0672a
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/AndFilterItemProvider.java
@@ -0,0 +1,125 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.AndFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class AndFilterItemProvider extends CombinedFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public AndFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This returns AndFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/AndFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassFilterItemProvider.java
new file mode 100644
index 0000000000..854ca5c520
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassFilterItemProvider.java
@@ -0,0 +1,173 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.ClassFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.ComposeableAdapterFactory;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+import org.eclipse.emf.edit.provider.ItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.ViewerNotification;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.ClassFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class ClassFilterItemProvider extends PermissionFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ClassFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+      addApplicableClassPropertyDescriptor(object);
+      addSubTypesPropertyDescriptor(object);
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This adds a property descriptor for the Applicable Class feature.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected void addApplicableClassPropertyDescriptor(Object object)
+  {
+    itemPropertyDescriptors.add(createItemPropertyDescriptor(
+        ((ComposeableAdapterFactory)adapterFactory).getRootAdapterFactory(),
+        getResourceLocator(),
+        getString("_UI_ClassFilter_applicableClass_feature"), //$NON-NLS-1$
+        getString(
+            "_UI_PropertyDescriptor_description", "_UI_ClassFilter_applicableClass_feature", "_UI_ClassFilter_type"), //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+        SecurityPackage.Literals.CLASS_FILTER__APPLICABLE_CLASS, true, false, true, null, null, null));
+  }
+
+  /**
+   * This adds a property descriptor for the Sub Types feature.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected void addSubTypesPropertyDescriptor(Object object)
+  {
+    itemPropertyDescriptors.add(createItemPropertyDescriptor(
+        ((ComposeableAdapterFactory)adapterFactory).getRootAdapterFactory(),
+        getResourceLocator(),
+        getString("_UI_ClassFilter_subTypes_feature"), //$NON-NLS-1$
+        getString("_UI_PropertyDescriptor_description", "_UI_ClassFilter_subTypes_feature", "_UI_ClassFilter_type"), //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+        SecurityPackage.Literals.CLASS_FILTER__SUB_TYPES, true, false, false,
+        ItemPropertyDescriptor.BOOLEAN_VALUE_IMAGE, null, null));
+  }
+
+  /**
+   * This returns ClassFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/ClassFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+
+    switch (notification.getFeatureID(ClassFilter.class))
+    {
+    case SecurityPackage.CLASS_FILTER__SUB_TYPES:
+      fireNotifyChanged(new ViewerNotification(notification, notification.getNotifier(), false, true));
+      return;
+    }
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassPermissionItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassPermissionItemProvider.java
index b201c3c438..b091dde7d6 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassPermissionItemProvider.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ClassPermissionItemProvider.java
@@ -46,6 +46,7 @@ import java.util.List;
  * <!-- end-user-doc -->
  * @generated
  */
+@Deprecated
 public class ClassPermissionItemProvider extends PermissionItemProvider implements IEditingDomainItemProvider,
     IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
     ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/CombinedFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/CombinedFilterItemProvider.java
new file mode 100644
index 0000000000..60475a796b
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/CombinedFilterItemProvider.java
@@ -0,0 +1,182 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.CombinedFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityFactory;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+import org.eclipse.emf.edit.provider.ViewerNotification;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.CombinedFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class CombinedFilterItemProvider extends PermissionFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public CombinedFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This specifies how to implement {@link #getChildren} and is used to deduce an appropriate feature for an
+   * {@link org.eclipse.emf.edit.command.AddCommand}, {@link org.eclipse.emf.edit.command.RemoveCommand} or
+   * {@link org.eclipse.emf.edit.command.MoveCommand} in {@link #createCommand}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Collection<? extends EStructuralFeature> getChildrenFeatures(Object object)
+  {
+    if (childrenFeatures == null)
+    {
+      super.getChildrenFeatures(object);
+      childrenFeatures.add(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS);
+    }
+    return childrenFeatures;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EStructuralFeature getChildFeature(Object object, Object child)
+  {
+    // Check the type of the specified child object and return the proper feature to use for
+    // adding (see {@link AddCommand}) it as a child.
+
+    return super.getChildFeature(object, child);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+
+    switch (notification.getFeatureID(CombinedFilter.class))
+    {
+    case SecurityPackage.COMBINED_FILTER__OPERANDS:
+      fireNotifyChanged(new ViewerNotification(notification, notification.getNotifier(), true, false));
+      return;
+    }
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createLinkedFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createPackageFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createClassFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createResourceFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createExpressionFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createNotFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createAndFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS,
+        SecurityFactory.eINSTANCE.createOrFilter()));
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ExpressionFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ExpressionFilterItemProvider.java
new file mode 100644
index 0000000000..43fe692af2
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ExpressionFilterItemProvider.java
@@ -0,0 +1,224 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.expressions.ExpressionsFactory;
+import org.eclipse.emf.cdo.security.ExpressionFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+import org.eclipse.emf.edit.provider.ViewerNotification;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.ExpressionFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class ExpressionFilterItemProvider extends ObjectFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ExpressionFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This specifies how to implement {@link #getChildren} and is used to deduce an appropriate feature for an
+   * {@link org.eclipse.emf.edit.command.AddCommand}, {@link org.eclipse.emf.edit.command.RemoveCommand} or
+   * {@link org.eclipse.emf.edit.command.MoveCommand} in {@link #createCommand}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Collection<? extends EStructuralFeature> getChildrenFeatures(Object object)
+  {
+    if (childrenFeatures == null)
+    {
+      super.getChildrenFeatures(object);
+      childrenFeatures.add(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION);
+    }
+    return childrenFeatures;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EStructuralFeature getChildFeature(Object object, Object child)
+  {
+    // Check the type of the specified child object and return the proper feature to use for
+    // adding (see {@link AddCommand}) it as a child.
+
+    return super.getChildFeature(object, child);
+  }
+
+  /**
+   * This returns ExpressionFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/ExpressionFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+
+    switch (notification.getFeatureID(ExpressionFilter.class))
+    {
+    case SecurityPackage.EXPRESSION_FILTER__EXPRESSION:
+      fireNotifyChanged(new ViewerNotification(notification, notification.getNotifier(), true, false));
+      return;
+    }
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createBooleanValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createByteValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createShortValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createIntValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createLongValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createFloatValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createDoubleValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createCharValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createStringValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createListValue()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createFunctionInvocation()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createMemberInvocation()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createMemberAccess()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createContextAccess()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createThis()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createContainedObject()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createLinkedObject()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION,
+        ExpressionsFactory.eINSTANCE.createLinkedExpression()));
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/FilterPermissionItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/FilterPermissionItemProvider.java
new file mode 100644
index 0000000000..df7f93ed7b
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/FilterPermissionItemProvider.java
@@ -0,0 +1,226 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.Access;
+import org.eclipse.emf.cdo.security.FilterPermission;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityFactory;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.common.util.EList;
+import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+import org.eclipse.emf.edit.provider.ViewerNotification;
+
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.FilterPermission} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class FilterPermissionItemProvider extends PermissionItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public FilterPermissionItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This specifies how to implement {@link #getChildren} and is used to deduce an appropriate feature for an
+   * {@link org.eclipse.emf.edit.command.AddCommand}, {@link org.eclipse.emf.edit.command.RemoveCommand} or
+   * {@link org.eclipse.emf.edit.command.MoveCommand} in {@link #createCommand}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Collection<? extends EStructuralFeature> getChildrenFeatures(Object object)
+  {
+    if (childrenFeatures == null)
+    {
+      super.getChildrenFeatures(object);
+      childrenFeatures.add(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS);
+    }
+    return childrenFeatures;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EStructuralFeature getChildFeature(Object object, Object child)
+  {
+    // Check the type of the specified child object and return the proper feature to use for
+    // adding (see {@link AddCommand}) it as a child.
+
+    return super.getChildFeature(object, child);
+  }
+
+  /**
+   * This returns FilterPermission.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/FilterPermission")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    FilterPermission permission = (FilterPermission)object;
+    Access access = permission.getAccess();
+    EList<PermissionFilter> filters = permission.getFilters();
+
+    StringBuilder builder = new StringBuilder();
+    builder.append(access == null ? "?" : access);
+
+    int size = filters.size();
+    if (size == 1)
+    {
+      builder.append(" ");
+      builder.append(filters.get(0).format());
+    }
+    else if (size > 1)
+    {
+      builder.append(" And(");
+
+      Iterator<PermissionFilter> iterator = filters.iterator();
+      builder.append(iterator.next().format());
+
+      while (iterator.hasNext())
+      {
+        builder.append(", ");
+        builder.append(iterator.next().format());
+      }
+
+      builder.append(")");
+    }
+
+    return builder.toString();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+
+    switch (notification.getFeatureID(FilterPermission.class))
+    {
+    case SecurityPackage.FILTER_PERMISSION__FILTERS:
+      fireNotifyChanged(new ViewerNotification(notification, notification.getNotifier(), true, false));
+      return;
+    }
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createLinkedFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createPackageFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createClassFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createResourceFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createExpressionFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createNotFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createAndFilter()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS,
+        SecurityFactory.eINSTANCE.createOrFilter()));
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/LinkedFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/LinkedFilterItemProvider.java
new file mode 100644
index 0000000000..abf0d1fe4d
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/LinkedFilterItemProvider.java
@@ -0,0 +1,143 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.ComposeableAdapterFactory;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.LinkedFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class LinkedFilterItemProvider extends PermissionFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public LinkedFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+      addFilterPropertyDescriptor(object);
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This adds a property descriptor for the Filter feature.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected void addFilterPropertyDescriptor(Object object)
+  {
+    itemPropertyDescriptors.add(createItemPropertyDescriptor(
+        ((ComposeableAdapterFactory)adapterFactory).getRootAdapterFactory(), getResourceLocator(),
+        getString("_UI_LinkedFilter_filter_feature"), //$NON-NLS-1$
+        getString("_UI_PropertyDescriptor_description", "_UI_LinkedFilter_filter_feature", "_UI_LinkedFilter_type"), //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+        SecurityPackage.Literals.LINKED_FILTER__FILTER, true, false, true, null, null, null));
+  }
+
+  /**
+   * This returns LinkedFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/LinkedFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/NotFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/NotFilterItemProvider.java
new file mode 100644
index 0000000000..6915874bef
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/NotFilterItemProvider.java
@@ -0,0 +1,125 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.NotFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class NotFilterItemProvider extends CombinedFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public NotFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This returns NotFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/NotFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectFilterItemProvider.java
new file mode 100644
index 0000000000..683f654f5a
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectFilterItemProvider.java
@@ -0,0 +1,113 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.ObjectFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class ObjectFilterItemProvider extends PermissionFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ObjectFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectPermissionItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectPermissionItemProvider.java
index 1b04adccbf..a6f84af7a8 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectPermissionItemProvider.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ObjectPermissionItemProvider.java
@@ -37,6 +37,7 @@ import java.util.List;
  * <!-- end-user-doc -->
  * @generated
  */
+@Deprecated
 public class ObjectPermissionItemProvider extends PermissionItemProvider implements IEditingDomainItemProvider,
     IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
     ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/OrFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/OrFilterItemProvider.java
new file mode 100644
index 0000000000..79a70902c3
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/OrFilterItemProvider.java
@@ -0,0 +1,125 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.OrFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class OrFilterItemProvider extends CombinedFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public OrFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This returns OrFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/OrFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackageFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackageFilterItemProvider.java
new file mode 100644
index 0000000000..6715f49a0d
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackageFilterItemProvider.java
@@ -0,0 +1,145 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.ComposeableAdapterFactory;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.PackageFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class PackageFilterItemProvider extends PermissionFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public PackageFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+      addApplicablePackagePropertyDescriptor(object);
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This adds a property descriptor for the Applicable Package feature.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected void addApplicablePackagePropertyDescriptor(Object object)
+  {
+    itemPropertyDescriptors
+        .add(createItemPropertyDescriptor(((ComposeableAdapterFactory)adapterFactory).getRootAdapterFactory(),
+            getResourceLocator(),
+            getString("_UI_PackageFilter_applicablePackage_feature"), //$NON-NLS-1$
+            getString(
+                "_UI_PropertyDescriptor_description", "_UI_PackageFilter_applicablePackage_feature", "_UI_PackageFilter_type"), //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+            SecurityPackage.Literals.PACKAGE_FILTER__APPLICABLE_PACKAGE, true, false, true, null, null, null));
+  }
+
+  /**
+   * This returns PackageFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/PackageFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackagePermissionItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackagePermissionItemProvider.java
index 760ae758c9..07eaea1577 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackagePermissionItemProvider.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PackagePermissionItemProvider.java
@@ -45,6 +45,7 @@ import java.util.List;
  * <!-- end-user-doc -->
  * @generated
  */
+@Deprecated
 public class PackagePermissionItemProvider extends PermissionItemProvider implements IEditingDomainItemProvider,
     IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
     ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PermissionFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PermissionFilterItemProvider.java
new file mode 100644
index 0000000000..317f2ca8bb
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/PermissionFilterItemProvider.java
@@ -0,0 +1,139 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.common.util.ResourceLocator;
+import org.eclipse.emf.edit.provider.IChildCreationExtender;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+import org.eclipse.emf.edit.provider.ItemProviderAdapter;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.PermissionFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class PermissionFilterItemProvider extends ItemProviderAdapter implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public PermissionFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public boolean hasChildren(Object object)
+  {
+    return hasChildren(object, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+  /**
+   * Return the resource locator for this item provider's resources.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public ResourceLocator getResourceLocator()
+  {
+    return ((IChildCreationExtender)adapterFactory).getResourceLocator();
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourceFilterItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourceFilterItemProvider.java
new file mode 100644
index 0000000000..66621e6eee
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourceFilterItemProvider.java
@@ -0,0 +1,175 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.provider;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.ResourceFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.notify.AdapterFactory;
+import org.eclipse.emf.common.notify.Notification;
+import org.eclipse.emf.edit.provider.ComposeableAdapterFactory;
+import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
+import org.eclipse.emf.edit.provider.IItemColorProvider;
+import org.eclipse.emf.edit.provider.IItemFontProvider;
+import org.eclipse.emf.edit.provider.IItemLabelProvider;
+import org.eclipse.emf.edit.provider.IItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.IItemPropertySource;
+import org.eclipse.emf.edit.provider.IStructuredItemContentProvider;
+import org.eclipse.emf.edit.provider.ITableItemColorProvider;
+import org.eclipse.emf.edit.provider.ITableItemFontProvider;
+import org.eclipse.emf.edit.provider.ITableItemLabelProvider;
+import org.eclipse.emf.edit.provider.ITreeItemContentProvider;
+import org.eclipse.emf.edit.provider.ItemPropertyDescriptor;
+import org.eclipse.emf.edit.provider.ViewerNotification;
+
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * This is the item provider adapter for a {@link org.eclipse.emf.cdo.security.ResourceFilter} object.
+ * <!-- begin-user-doc -->
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @generated
+ */
+public class ResourceFilterItemProvider extends PermissionFilterItemProvider implements IEditingDomainItemProvider,
+    IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
+    ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
+{
+  /**
+   * This constructs an instance from a factory and a notifier.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ResourceFilterItemProvider(AdapterFactory adapterFactory)
+  {
+    super(adapterFactory);
+  }
+
+  /**
+   * This returns the property descriptors for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public List<IItemPropertyDescriptor> getPropertyDescriptors(Object object)
+  {
+    if (itemPropertyDescriptors == null)
+    {
+      super.getPropertyDescriptors(object);
+
+      addPathPropertyDescriptor(object);
+      addInclusionPropertyDescriptor(object);
+    }
+    return itemPropertyDescriptors;
+  }
+
+  /**
+   * This adds a property descriptor for the Path feature.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected void addPathPropertyDescriptor(Object object)
+  {
+    itemPropertyDescriptors.add(createItemPropertyDescriptor(
+        ((ComposeableAdapterFactory)adapterFactory).getRootAdapterFactory(),
+        getResourceLocator(),
+        getString("_UI_ResourceFilter_path_feature"), //$NON-NLS-1$
+        getString("_UI_PropertyDescriptor_description", "_UI_ResourceFilter_path_feature", "_UI_ResourceFilter_type"), //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+        SecurityPackage.Literals.RESOURCE_FILTER__PATH, true, false, false, ItemPropertyDescriptor.GENERIC_VALUE_IMAGE,
+        null, null));
+  }
+
+  /**
+   * This adds a property descriptor for the Inclusion feature.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected void addInclusionPropertyDescriptor(Object object)
+  {
+    itemPropertyDescriptors.add(createItemPropertyDescriptor(
+        ((ComposeableAdapterFactory)adapterFactory).getRootAdapterFactory(),
+        getResourceLocator(),
+        getString("_UI_ResourceFilter_inclusion_feature"), //$NON-NLS-1$
+        getString(
+            "_UI_PropertyDescriptor_description", "_UI_ResourceFilter_inclusion_feature", "_UI_ResourceFilter_type"), //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+        SecurityPackage.Literals.RESOURCE_FILTER__INCLUSION, true, false, false,
+        ItemPropertyDescriptor.GENERIC_VALUE_IMAGE, null, null));
+  }
+
+  /**
+   * This returns ResourceFilter.gif.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Object getImage(Object object)
+  {
+    return overlayImage(object, getResourceLocator().getImage("full/obj16/ResourceFilter")); //$NON-NLS-1$
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected boolean shouldComposeCreationImage()
+  {
+    return true;
+  }
+
+  /**
+   * This returns the label text for the adapted class.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated NOT
+   */
+  @Override
+  public String getText(Object object)
+  {
+    return ((PermissionFilter)object).format();
+  }
+
+  /**
+   * This handles model notifications by calling {@link #updateChildren} to update any cached
+   * children and by creating a viewer notification, which it passes to {@link #fireNotifyChanged}.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public void notifyChanged(Notification notification)
+  {
+    updateChildren(notification);
+
+    switch (notification.getFeatureID(ResourceFilter.class))
+    {
+    case SecurityPackage.RESOURCE_FILTER__PATH:
+    case SecurityPackage.RESOURCE_FILTER__INCLUSION:
+      fireNotifyChanged(new ViewerNotification(notification, notification.getNotifier(), false, true));
+      return;
+    }
+    super.notifyChanged(notification);
+  }
+
+  /**
+   * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
+   * that can be created under this object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    super.collectNewChildDescriptors(newChildDescriptors, object);
+  }
+
+}
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourcePermissionItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourcePermissionItemProvider.java
index 829bc4e122..4d935b70a8 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourcePermissionItemProvider.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/ResourcePermissionItemProvider.java
@@ -40,6 +40,7 @@ import java.util.List;
  * <!-- end-user-doc -->
  * @generated
  */
+@Deprecated
 public class ResourcePermissionItemProvider extends PermissionItemProvider implements IEditingDomainItemProvider,
     IStructuredItemContentProvider, ITreeItemContentProvider, IItemLabelProvider, IItemPropertySource,
     ITableItemLabelProvider, ITableItemColorProvider, ITableItemFontProvider, IItemColorProvider, IItemFontProvider
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/RoleItemProvider.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/RoleItemProvider.java
index 0bc11cae52..139104c2a0 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/RoleItemProvider.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/RoleItemProvider.java
@@ -17,6 +17,7 @@ import org.eclipse.emf.cdo.security.SecurityPackage;
 import org.eclipse.emf.common.notify.AdapterFactory;
 import org.eclipse.emf.common.notify.Notification;
 import org.eclipse.emf.ecore.EStructuralFeature;
+import org.eclipse.emf.edit.command.CommandParameter;
 import org.eclipse.emf.edit.provider.ComposeableAdapterFactory;
 import org.eclipse.emf.edit.provider.IEditingDomainItemProvider;
 import org.eclipse.emf.edit.provider.IItemColorProvider;
@@ -33,6 +34,7 @@ import org.eclipse.emf.edit.provider.ItemPropertyDescriptor;
 import org.eclipse.emf.edit.provider.ViewerNotification;
 
 import java.util.Collection;
+import java.util.Iterator;
 import java.util.List;
 
 /**
@@ -203,11 +205,12 @@ public class RoleItemProvider extends SecurityItemItemProvider implements IEditi
    * This adds {@link org.eclipse.emf.edit.command.CommandParameter}s describing the children
    * that can be created under this object.
    * <!-- begin-user-doc -->
+   * @since 4.3
    * <!-- end-user-doc -->
    * @generated
    */
-  @Override
-  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  @SuppressWarnings("deprecation")
+  protected void collectNewChildDescriptorsGen(Collection<Object> newChildDescriptors, Object object)
   {
     super.collectNewChildDescriptors(newChildDescriptors, object);
 
@@ -219,6 +222,31 @@ public class RoleItemProvider extends SecurityItemItemProvider implements IEditi
 
     newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.ROLE__PERMISSIONS,
         SecurityFactory.eINSTANCE.createResourcePermission()));
+
+    newChildDescriptors.add(createChildParameter(SecurityPackage.Literals.ROLE__PERMISSIONS,
+        SecurityFactory.eINSTANCE.createFilterPermission()));
+  }
+
+  @Override
+  @SuppressWarnings("deprecation")
+  protected void collectNewChildDescriptors(Collection<Object> newChildDescriptors, Object object)
+  {
+    collectNewChildDescriptorsGen(newChildDescriptors, object);
+
+    for (Iterator<Object> it = newChildDescriptors.iterator(); it.hasNext();)
+    {
+      Object newChildDescriptor = it.next();
+      if (newChildDescriptor instanceof CommandParameter)
+      {
+        Object value = ((CommandParameter)newChildDescriptor).getValue();
+        if (value instanceof org.eclipse.emf.cdo.security.ClassPermission
+            || value instanceof org.eclipse.emf.cdo.security.PackagePermission
+            || value instanceof org.eclipse.emf.cdo.security.ResourcePermission)
+        {
+          it.remove();
+        }
+      }
+    }
   }
 
 }
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityEditPlugin.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityEditPlugin.java
index d811abbc4d..ca2dec0422 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityEditPlugin.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityEditPlugin.java
@@ -11,6 +11,7 @@
 package org.eclipse.emf.cdo.security.provider;
 
 import org.eclipse.emf.cdo.edit.CDOEditPlugin;
+import org.eclipse.emf.cdo.expressions.provider.ExpressionsEditPlugin;
 
 import org.eclipse.emf.common.EMFPlugin;
 import org.eclipse.emf.common.util.ResourceLocator;
@@ -48,7 +49,7 @@ public final class SecurityEditPlugin extends EMFPlugin
    */
   public SecurityEditPlugin()
   {
-    super(new ResourceLocator[] { EcoreEditPlugin.INSTANCE, CDOEditPlugin.INSTANCE, });
+    super(new ResourceLocator[] { EcoreEditPlugin.INSTANCE, CDOEditPlugin.INSTANCE, ExpressionsEditPlugin.INSTANCE, });
   }
 
   /**
diff --git a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityItemProviderAdapterFactory.java b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityItemProviderAdapterFactory.java
index 90913f901a..8a77fb53af 100644
--- a/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityItemProviderAdapterFactory.java
+++ b/plugins/org.eclipse.emf.cdo.security.edit/src/org/eclipse/emf/cdo/security/provider/SecurityItemProviderAdapterFactory.java
@@ -262,6 +262,7 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   protected ClassPermissionItemProvider classPermissionItemProvider;
 
   /**
@@ -270,6 +271,7 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   @Override
   public Adapter createClassPermissionAdapter()
   {
@@ -287,6 +289,7 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   protected PackagePermissionItemProvider packagePermissionItemProvider;
 
   /**
@@ -295,6 +298,7 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   @Override
   public Adapter createPackagePermissionAdapter()
   {
@@ -312,6 +316,7 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   protected ResourcePermissionItemProvider resourcePermissionItemProvider;
 
   /**
@@ -320,6 +325,7 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   @Override
   public Adapter createResourcePermissionAdapter()
   {
@@ -332,6 +338,249 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
   }
 
   /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.FilterPermission} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected FilterPermissionItemProvider filterPermissionItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.FilterPermission}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createFilterPermissionAdapter()
+  {
+    if (filterPermissionItemProvider == null)
+    {
+      filterPermissionItemProvider = new FilterPermissionItemProvider(this);
+    }
+
+    return filterPermissionItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.LinkedFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected LinkedFilterItemProvider linkedFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.LinkedFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createLinkedFilterAdapter()
+  {
+    if (linkedFilterItemProvider == null)
+    {
+      linkedFilterItemProvider = new LinkedFilterItemProvider(this);
+    }
+
+    return linkedFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.PackageFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected PackageFilterItemProvider packageFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.PackageFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createPackageFilterAdapter()
+  {
+    if (packageFilterItemProvider == null)
+    {
+      packageFilterItemProvider = new PackageFilterItemProvider(this);
+    }
+
+    return packageFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.ClassFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ClassFilterItemProvider classFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.ClassFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createClassFilterAdapter()
+  {
+    if (classFilterItemProvider == null)
+    {
+      classFilterItemProvider = new ClassFilterItemProvider(this);
+    }
+
+    return classFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.ResourceFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ResourceFilterItemProvider resourceFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.ResourceFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createResourceFilterAdapter()
+  {
+    if (resourceFilterItemProvider == null)
+    {
+      resourceFilterItemProvider = new ResourceFilterItemProvider(this);
+    }
+
+    return resourceFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.ExpressionFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ExpressionFilterItemProvider expressionFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.ExpressionFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createExpressionFilterAdapter()
+  {
+    if (expressionFilterItemProvider == null)
+    {
+      expressionFilterItemProvider = new ExpressionFilterItemProvider(this);
+    }
+
+    return expressionFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.NotFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected NotFilterItemProvider notFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.NotFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createNotFilterAdapter()
+  {
+    if (notFilterItemProvider == null)
+    {
+      notFilterItemProvider = new NotFilterItemProvider(this);
+    }
+
+    return notFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.AndFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected AndFilterItemProvider andFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.AndFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createAndFilterAdapter()
+  {
+    if (andFilterItemProvider == null)
+    {
+      andFilterItemProvider = new AndFilterItemProvider(this);
+    }
+
+    return andFilterItemProvider;
+  }
+
+  /**
+   * This keeps track of the one adapter used for all {@link org.eclipse.emf.cdo.security.OrFilter} instances.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected OrFilterItemProvider orFilterItemProvider;
+
+  /**
+   * This creates an adapter for a {@link org.eclipse.emf.cdo.security.OrFilter}.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public Adapter createOrFilterAdapter()
+  {
+    if (orFilterItemProvider == null)
+    {
+      orFilterItemProvider = new OrFilterItemProvider(this);
+    }
+
+    return orFilterItemProvider;
+  }
+
+  /**
    * This returns the root adapter factory that contains this factory.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -490,6 +739,24 @@ public class SecurityItemProviderAdapterFactory extends SecurityAdapterFactory i
       packagePermissionItemProvider.dispose();
     if (resourcePermissionItemProvider != null)
       resourcePermissionItemProvider.dispose();
+    if (filterPermissionItemProvider != null)
+      filterPermissionItemProvider.dispose();
+    if (linkedFilterItemProvider != null)
+      linkedFilterItemProvider.dispose();
+    if (packageFilterItemProvider != null)
+      packageFilterItemProvider.dispose();
+    if (classFilterItemProvider != null)
+      classFilterItemProvider.dispose();
+    if (resourceFilterItemProvider != null)
+      resourceFilterItemProvider.dispose();
+    if (expressionFilterItemProvider != null)
+      expressionFilterItemProvider.dispose();
+    if (notFilterItemProvider != null)
+      notFilterItemProvider.dispose();
+    if (andFilterItemProvider != null)
+      andFilterItemProvider.dispose();
+    if (orFilterItemProvider != null)
+      orFilterItemProvider.dispose();
   }
 
 }
diff --git a/plugins/org.eclipse.emf.cdo.security.editor/META-INF/MANIFEST.MF b/plugins/org.eclipse.emf.cdo.security.editor/META-INF/MANIFEST.MF
index a5efd257ec..a69e9fde99 100644
--- a/plugins/org.eclipse.emf.cdo.security.editor/META-INF/MANIFEST.MF
+++ b/plugins/org.eclipse.emf.cdo.security.editor/META-INF/MANIFEST.MF
@@ -1,16 +1,15 @@
 Manifest-Version: 1.0
 Bundle-ManifestVersion: 2
 Bundle-SymbolicName: org.eclipse.emf.cdo.security.editor;singleton:=true
-Bundle-Version: 4.2.0.qualifier
+Bundle-Version: 4.2.100.qualifier
 Bundle-Localization: plugin
 Bundle-Name: %pluginName
 Bundle-Vendor: %providerName
 Bundle-ClassPath: .
 Bundle-Activator: org.eclipse.emf.cdo.security.presentation.SecurityEditorPlugin$Implementation
 Bundle-RequiredExecutionEnvironment: J2SE-1.5
-Export-Package: org.eclipse.emf.cdo.security.presentation;version="4.1.0";x-internal:=true
-Require-Bundle: org.eclipse.core.runtime;bundle-version="[3.5.0,4.0.0)",
- org.eclipse.core.resources;bundle-version="[3.5.0,4.0.0)";visibility:=reexport,
+Export-Package: org.eclipse.emf.cdo.security.presentation;version="4.2.100";x-internal:=true
+Require-Bundle: org.eclipse.core.resources;bundle-version="[3.5.0,4.0.0)";visibility:=reexport,
  org.eclipse.ui.ide;bundle-version="[3.5.0,4.0.0)";visibility:=reexport,
  org.eclipse.emf.ecore.xmi;bundle-version="[2.5.0,3.0.0)";visibility:=reexport,
  org.eclipse.emf.edit.ui;bundle-version="[2.5.0,3.0.0)";visibility:=reexport,
diff --git a/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditor.java b/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditor.java
index 3ce7d78b92..4c93c7437d 100644
--- a/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditor.java
+++ b/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditor.java
@@ -11,6 +11,7 @@
 package org.eclipse.emf.cdo.security.presentation;
 
 import org.eclipse.emf.cdo.etypes.provider.EtypesItemProviderAdapterFactory;
+import org.eclipse.emf.cdo.expressions.provider.ExpressionsItemProviderAdapterFactory;
 import org.eclipse.emf.cdo.security.provider.SecurityItemProviderAdapterFactory;
 
 import org.eclipse.emf.common.command.BasicCommandStack;
@@ -25,8 +26,6 @@ import org.eclipse.emf.common.ui.viewer.IViewerProvider;
 import org.eclipse.emf.common.util.BasicDiagnostic;
 import org.eclipse.emf.common.util.Diagnostic;
 import org.eclipse.emf.common.util.URI;
-import org.eclipse.emf.ecore.EObject;
-import org.eclipse.emf.ecore.EValidator;
 import org.eclipse.emf.ecore.provider.EcoreItemProviderAdapterFactory;
 import org.eclipse.emf.ecore.resource.Resource;
 import org.eclipse.emf.ecore.resource.ResourceSet;
@@ -176,7 +175,7 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
    * <!-- end-user-doc -->
    * @generated
    */
-  protected PropertySheetPage propertySheetPage;
+  protected List<PropertySheetPage> propertySheetPages = new ArrayList<PropertySheetPage>();
 
   /**
    * This is the viewer that shadows the selection in the content outline.
@@ -249,7 +248,7 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
       }
       else if (p instanceof PropertySheet)
       {
-        if (((PropertySheet)p).getCurrentPage() == propertySheetPage)
+        if (propertySheetPages.contains(((PropertySheet)p).getCurrentPage()))
         {
           getActionBarContributor().setActiveEditor(SecurityEditor.this);
           handleActivate();
@@ -382,6 +381,17 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
     protected void unsetTarget(Resource target)
     {
       basicUnsetTarget(target);
+      resourceToDiagnosticMap.remove(target);
+      if (updateProblemIndication)
+      {
+        getSite().getShell().getDisplay().asyncExec(new Runnable()
+        {
+          public void run()
+          {
+            updateProblemIndication();
+          }
+        });
+      }
     }
   };
 
@@ -427,6 +437,7 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
                   }
                 }
               }
+              return false;
             }
 
             return true;
@@ -675,6 +686,7 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
     adapterFactory.addAdapterFactory(new SecurityItemProviderAdapterFactory());
     adapterFactory.addAdapterFactory(new EcoreItemProviderAdapterFactory());
     adapterFactory.addAdapterFactory(new EtypesItemProviderAdapterFactory());
+    adapterFactory.addAdapterFactory(new ExpressionsItemProviderAdapterFactory());
     adapterFactory.addAdapterFactory(new ReflectiveItemProviderAdapterFactory());
 
     // Create the command stack that will notify this editor as commands are executed.
@@ -700,9 +712,17 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
             {
               setSelectionToViewer(mostRecentCommand.getAffectedObjects());
             }
-            if (propertySheetPage != null && !propertySheetPage.getControl().isDisposed())
+            for (Iterator<PropertySheetPage> i = propertySheetPages.iterator(); i.hasNext();)
             {
-              propertySheetPage.refresh();
+              PropertySheetPage propertySheetPage = i.next();
+              if (propertySheetPage.getControl().isDisposed())
+              {
+                i.remove();
+              }
+              else
+              {
+                propertySheetPage.refresh();
+              }
             }
           }
         });
@@ -1220,26 +1240,24 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
    */
   public IPropertySheetPage getPropertySheetPage()
   {
-    if (propertySheetPage == null)
+    PropertySheetPage propertySheetPage = new ExtendedPropertySheetPage(editingDomain)
     {
-      propertySheetPage = new ExtendedPropertySheetPage(editingDomain)
+      @Override
+      public void setSelectionToViewer(List<?> selection)
       {
-        @Override
-        public void setSelectionToViewer(List<?> selection)
-        {
-          SecurityEditor.this.setSelectionToViewer(selection);
-          SecurityEditor.this.setFocus();
-        }
+        SecurityEditor.this.setSelectionToViewer(selection);
+        SecurityEditor.this.setFocus();
+      }
 
-        @Override
-        public void setActionBars(IActionBars actionBars)
-        {
-          super.setActionBars(actionBars);
-          getActionBarContributor().shareGlobalActions(this, actionBars);
-        }
-      };
-      propertySheetPage.setPropertySourceProvider(new AdapterFactoryContentProvider(adapterFactory));
-    }
+      @Override
+      public void setActionBars(IActionBars actionBars)
+      {
+        super.setActionBars(actionBars);
+        getActionBarContributor().shareGlobalActions(this, actionBars);
+      }
+    };
+    propertySheetPage.setPropertySourceProvider(new AdapterFactoryContentProvider(adapterFactory));
+    propertySheetPages.add(propertySheetPage);
 
     return propertySheetPage;
   }
@@ -1361,7 +1379,7 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
 
   /**
    * This returns whether something has been persisted to the URI of the specified resource.
-   * The implementation uses the URI converter from the editor's resource set to try to open an input stream. 
+   * The implementation uses the URI converter from the editor's resource set to try to open an input stream.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
    * @generated
@@ -1441,25 +1459,10 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
    */
   public void gotoMarker(IMarker marker)
   {
-    try
+    List<?> targetObjects = markerHelper.getTargetObjects(editingDomain, marker);
+    if (!targetObjects.isEmpty())
     {
-      if (marker.getType().equals(EValidator.MARKER))
-      {
-        String uriAttribute = marker.getAttribute(EValidator.URI_ATTRIBUTE, null);
-        if (uriAttribute != null)
-        {
-          URI uri = URI.createURI(uriAttribute);
-          EObject eObject = editingDomain.getResourceSet().getEObject(uri, true);
-          if (eObject != null)
-          {
-            setSelectionToViewer(Collections.singleton(editingDomain.getWrapper(eObject)));
-          }
-        }
-      }
-    }
-    catch (CoreException exception)
-    {
-      SecurityEditorPlugin.INSTANCE.log(exception);
+      setSelectionToViewer(targetObjects);
     }
   }
 
@@ -1668,7 +1671,7 @@ public class SecurityEditor extends MultiPageEditorPart implements IEditingDomai
       getActionBarContributor().setActiveEditor(null);
     }
 
-    if (propertySheetPage != null)
+    for (PropertySheetPage propertySheetPage : propertySheetPages)
     {
       propertySheetPage.dispose();
     }
diff --git a/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditorPlugin.java b/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditorPlugin.java
index 3cced58788..758e92e21a 100644
--- a/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditorPlugin.java
+++ b/plugins/org.eclipse.emf.cdo.security.editor/src/org/eclipse/emf/cdo/security/presentation/SecurityEditorPlugin.java
@@ -11,6 +11,7 @@
 package org.eclipse.emf.cdo.security.presentation;
 
 import org.eclipse.emf.cdo.edit.CDOEditPlugin;
+import org.eclipse.emf.cdo.expressions.provider.ExpressionsEditPlugin;
 
 import org.eclipse.emf.common.EMFPlugin;
 import org.eclipse.emf.common.ui.EclipseUIPlugin;
@@ -49,7 +50,7 @@ public final class SecurityEditorPlugin extends EMFPlugin
    */
   public SecurityEditorPlugin()
   {
-    super(new ResourceLocator[] { EcoreEditPlugin.INSTANCE, CDOEditPlugin.INSTANCE, });
+    super(new ResourceLocator[] { EcoreEditPlugin.INSTANCE, CDOEditPlugin.INSTANCE, ExpressionsEditPlugin.INSTANCE, });
   }
 
   /**
diff --git a/plugins/org.eclipse.emf.cdo.security/.settings/.api_filters b/plugins/org.eclipse.emf.cdo.security/.settings/.api_filters
index 2ffed666bf..e8bc0cd60a 100644
--- a/plugins/org.eclipse.emf.cdo.security/.settings/.api_filters
+++ b/plugins/org.eclipse.emf.cdo.security/.settings/.api_filters
@@ -1,5 +1,209 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <component id="org.eclipse.emf.cdo.security" version="2">
+    <resource path="src/org/eclipse/emf/cdo/security/SecurityPackage.java" type="org.eclipse.emf.cdo.security.SecurityPackage">
+        <filter id="388194388">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage"/>
+                <message_argument value="ACCESS"/>
+                <message_argument value="14"/>
+            </message_arguments>
+        </filter>
+        <filter id="388194388">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage"/>
+                <message_argument value="ACCESS_OBJECT"/>
+                <message_argument value="15"/>
+            </message_arguments>
+        </filter>
+    </resource>
+    <resource path="src/org/eclipse/emf/cdo/security/SecurityPackage.java" type="org.eclipse.emf.cdo.security.SecurityPackage$Literals">
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="AND_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="CLASS_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="CLASS_FILTER__APPLICABLE_CLASS"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="CLASS_FILTER__SUB_TYPES"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="COMBINED_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="COMBINED_FILTER__OPERANDS"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="EXPRESSION_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="EXPRESSION_FILTER__EXPRESSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="EXPRESSION_PERMISSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="EXPRESSION_PERMISSION__EXPRESSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="FILTER_PERMISSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="FILTER_PERMISSION__FILTERS"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="INCLUSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="LINKED_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="LINKED_FILTER__FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="LOGICAL_OPERATOR"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="LOGICAL_PERMISSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="LOGICAL_PERMISSION__OPERANDS"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="LOGICAL_PERMISSION__OPERATOR"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="NOT_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="OBJECT_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="OR_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="PACKAGE_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="PACKAGE_FILTER__APPLICABLE_PACKAGE"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="PERMISSION_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="REFERENCE_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="REFERENCE_FILTER__REFERENCE"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="RESOURCE_FILTER"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="RESOURCE_FILTER__INCLUSION"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="RESOURCE_FILTER__PATH"/>
+            </message_arguments>
+        </filter>
+        <filter id="403767336">
+            <message_arguments>
+                <message_argument value="org.eclipse.emf.cdo.security.SecurityPackage.Literals"/>
+                <message_argument value="RESOURCE_FILTER__PATTERN"/>
+            </message_arguments>
+        </filter>
+    </resource>
     <resource path="src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java" type="org.eclipse.emf.cdo.security.impl.SecurityFactoryImpl">
         <filter id="1143996420">
             <message_arguments>
diff --git a/plugins/org.eclipse.emf.cdo.security/.settings/org.eclipse.core.resources.prefs b/plugins/org.eclipse.emf.cdo.security/.settings/org.eclipse.core.resources.prefs
index 16e90836c7..4b2942804b 100644
--- a/plugins/org.eclipse.emf.cdo.security/.settings/org.eclipse.core.resources.prefs
+++ b/plugins/org.eclipse.emf.cdo.security/.settings/org.eclipse.core.resources.prefs
@@ -1,4 +1,2 @@
 eclipse.preferences.version=1
-
 encoding//model/security.ecore=UTF-8
-encoding//model/security.ecorediag=UTF-8
diff --git a/plugins/org.eclipse.emf.cdo.security/META-INF/MANIFEST.MF b/plugins/org.eclipse.emf.cdo.security/META-INF/MANIFEST.MF
index 0013302e9e..b6f245c59e 100644
--- a/plugins/org.eclipse.emf.cdo.security/META-INF/MANIFEST.MF
+++ b/plugins/org.eclipse.emf.cdo.security/META-INF/MANIFEST.MF
@@ -2,14 +2,15 @@ Manifest-Version: 1.0
 Bundle-ManifestVersion: 2
 Bundle-Name: %pluginName
 Bundle-SymbolicName: org.eclipse.emf.cdo.security;singleton:=true
-Bundle-Version: 4.2.100.qualifier
+Bundle-Version: 4.3.0.qualifier
 Bundle-ClassPath: .
 Bundle-Vendor: %providerName
 Bundle-Localization: plugin
 Bundle-RequiredExecutionEnvironment: J2SE-1.5
-Export-Package: org.eclipse.emf.cdo.internal.security;version="4.2.100";x-friends:="org.eclipse.emf.cdo.security.edit,org.eclipse.emf.cdo.security.editor,org.eclipse.emf.cdo.server.security",
- org.eclipse.emf.cdo.security;version="4.2.100",
- org.eclipse.emf.cdo.security.impl;version="4.2.100",
- org.eclipse.emf.cdo.security.util;version="4.2.100"
-Require-Bundle: org.eclipse.emf.cdo;bundle-version="[4.1.0,5.0.0)";visibility:=reexport
+Export-Package: org.eclipse.emf.cdo.internal.security;version="4.3.0";x-friends:="org.eclipse.emf.cdo.security.edit,org.eclipse.emf.cdo.security.editor,org.eclipse.emf.cdo.server.security",
+ org.eclipse.emf.cdo.security;version="4.3.0",
+ org.eclipse.emf.cdo.security.impl;version="4.3.0",
+ org.eclipse.emf.cdo.security.util;version="4.3.0"
+Require-Bundle: org.eclipse.emf.cdo;bundle-version="[4.1.0,5.0.0)";visibility:=reexport,
+ org.eclipse.emf.cdo.expressions;bundle-version="[4.3.0,5.0.0)";visibility:=reexport
 Bundle-ActivationPolicy: lazy
diff --git a/plugins/org.eclipse.emf.cdo.security/model/security.ecore b/plugins/org.eclipse.emf.cdo.security/model/security.ecore
index 160b49f153..8e0a263002 100644
--- a/plugins/org.eclipse.emf.cdo.security/model/security.ecore
+++ b/plugins/org.eclipse.emf.cdo.security/model/security.ecore
@@ -102,6 +102,49 @@
     <eStructuralFeatures xsi:type="ecore:EAttribute" name="pattern" eType="ecore:EDataType platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EString"/>
   </eClassifiers>
   <eClassifiers xsi:type="ecore:EClass" name="ObjectPermission" abstract="true" eSuperTypes="#//Permission"/>
+  <eClassifiers xsi:type="ecore:EClass" name="FilterPermission" eSuperTypes="#//Permission">
+    <eStructuralFeatures xsi:type="ecore:EReference" name="filters" lowerBound="1"
+        upperBound="-1" eType="#//PermissionFilter" containment="true"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="PermissionFilter" abstract="true"/>
+  <eClassifiers xsi:type="ecore:EClass" name="LinkedFilter" eSuperTypes="#//PermissionFilter">
+    <eStructuralFeatures xsi:type="ecore:EReference" name="filter" lowerBound="1"
+        eType="#//PermissionFilter"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="PackageFilter" eSuperTypes="#//PermissionFilter">
+    <eStructuralFeatures xsi:type="ecore:EReference" name="applicablePackage" lowerBound="1"
+        eType="ecore:EClass platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EPackage"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="ClassFilter" eSuperTypes="#//PermissionFilter">
+    <eStructuralFeatures xsi:type="ecore:EReference" name="applicableClass" lowerBound="1"
+        eType="ecore:EClass platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EClass"/>
+    <eStructuralFeatures xsi:type="ecore:EAttribute" name="subTypes" eType="ecore:EDataType platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EBoolean"
+        defaultValueLiteral="true"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="ResourceFilter" eSuperTypes="#//PermissionFilter">
+    <eStructuralFeatures xsi:type="ecore:EAttribute" name="path" eType="ecore:EDataType platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EString"/>
+    <eStructuralFeatures xsi:type="ecore:EAttribute" name="inclusion" eType="#//Inclusion"
+        defaultValueLiteral="Regex"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="ObjectFilter" abstract="true" eSuperTypes="#//PermissionFilter"/>
+  <eClassifiers xsi:type="ecore:EClass" name="ExpressionFilter" eSuperTypes="#//ObjectFilter">
+    <eStructuralFeatures xsi:type="ecore:EReference" name="expression" lowerBound="1"
+        eType="ecore:EClass ../../org.eclipse.emf.cdo.expressions/model/expressions.ecore#//Expression"
+        containment="true"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="CombinedFilter" abstract="true" eSuperTypes="#//PermissionFilter">
+    <eStructuralFeatures xsi:type="ecore:EReference" name="operands" lowerBound="1"
+        upperBound="-1" eType="#//PermissionFilter" containment="true"/>
+  </eClassifiers>
+  <eClassifiers xsi:type="ecore:EClass" name="NotFilter" eSuperTypes="#//CombinedFilter"/>
+  <eClassifiers xsi:type="ecore:EClass" name="AndFilter" eSuperTypes="#//CombinedFilter"/>
+  <eClassifiers xsi:type="ecore:EClass" name="OrFilter" eSuperTypes="#//CombinedFilter"/>
+  <eClassifiers xsi:type="ecore:EEnum" name="Inclusion">
+    <eLiterals name="Exact"/>
+    <eLiterals name="ExactAndUp" value="1"/>
+    <eLiterals name="ExactAndDown" value="2"/>
+    <eLiterals name="Regex" value="3"/>
+  </eClassifiers>
   <eClassifiers xsi:type="ecore:EEnum" name="Access">
     <eLiterals name="READ"/>
     <eLiterals name="WRITE" value="1"/>
diff --git a/plugins/org.eclipse.emf.cdo.security/model/security.ecorediag b/plugins/org.eclipse.emf.cdo.security/model/security.ecorediag
index 6be49fb075..152ba22b3d 100644
--- a/plugins/org.eclipse.emf.cdo.security/model/security.ecorediag
+++ b/plugins/org.eclipse.emf.cdo.security/model/security.ecorediag
@@ -18,23 +18,23 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_BlvtcawpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//SecurityElement"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlvtcqwpEeGqBf0LMO47dg" x="310" y="20"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlvtcqwpEeGqBf0LMO47dg" x="325" y="20"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_BlxioqwpEeGqBf0LMO47dg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_BlyJsKwpEeGqBf0LMO47dg" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="_BlyJsawpEeGqBf0LMO47dg" type="5001">
+    <children xmi:type="notation:Node" xmi:id="_BlyJsawpEeGqBf0LMO47dg" visible="false" type="5001">
       <styles xmi:type="notation:DrawerStyle" xmi:id="_BlyJsqwpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:SortingStyle" xmi:id="_BlyJs6wpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:FilteringStyle" xmi:id="_BlyJtKwpEeGqBf0LMO47dg"/>
     </children>
-    <children xmi:type="notation:Node" xmi:id="_BlyJtawpEeGqBf0LMO47dg" type="5002">
+    <children xmi:type="notation:Node" xmi:id="_BlyJtawpEeGqBf0LMO47dg" visible="false" type="5002">
       <styles xmi:type="notation:DrawerStyle" xmi:id="_BlyJtqwpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:SortingStyle" xmi:id="_BlyJt6wpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:FilteringStyle" xmi:id="_BlyJuKwpEeGqBf0LMO47dg"/>
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_Blxio6wpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//SecurityItem"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlxipKwpEeGqBf0LMO47dg" x="236" y="136"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlxipKwpEeGqBf0LMO47dg" x="236" y="121"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_BlywyqwpEeGqBf0LMO47dg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_BlzX0KwpEeGqBf0LMO47dg" type="4001"/>
@@ -54,7 +54,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_Blywy6wpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//Directory"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlywzKwpEeGqBf0LMO47dg" x="97" y="245"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlywzKwpEeGqBf0LMO47dg" x="97" y="256"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_BlzX26wpEeGqBf0LMO47dg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_Blz-4KwpEeGqBf0LMO47dg" type="4001"/>
@@ -74,7 +74,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_BlzX3KwpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//Role"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlzX3awpEeGqBf0LMO47dg" x="511" y="245"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_BlzX3awpEeGqBf0LMO47dg" x="522" y="256"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_Bl0l8KwpEeGqBf0LMO47dg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_Bl0l86wpEeGqBf0LMO47dg" type="4001"/>
@@ -94,23 +94,23 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_Bl0l8awpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//Assignee"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Bl0l8qwpEeGqBf0LMO47dg" x="236" y="245"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Bl0l8qwpEeGqBf0LMO47dg" x="236" y="256"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_Bl1NAqwpEeGqBf0LMO47dg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_Bl10EKwpEeGqBf0LMO47dg" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="_Bl10EawpEeGqBf0LMO47dg" type="5001">
+    <children xmi:type="notation:Node" xmi:id="_Bl10EawpEeGqBf0LMO47dg" visible="false" type="5001">
       <styles xmi:type="notation:DrawerStyle" xmi:id="_Bl10EqwpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:SortingStyle" xmi:id="_Bl10E6wpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:FilteringStyle" xmi:id="_Bl10FKwpEeGqBf0LMO47dg"/>
     </children>
-    <children xmi:type="notation:Node" xmi:id="_Bl10FawpEeGqBf0LMO47dg" type="5002">
+    <children xmi:type="notation:Node" xmi:id="_Bl10FawpEeGqBf0LMO47dg" visible="false" type="5002">
       <styles xmi:type="notation:DrawerStyle" xmi:id="_Bl10FqwpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:SortingStyle" xmi:id="_Bl10F6wpEeGqBf0LMO47dg"/>
       <styles xmi:type="notation:FilteringStyle" xmi:id="_Bl10GKwpEeGqBf0LMO47dg"/>
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_Bl1NA6wpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//Group"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Bl1NBKwpEeGqBf0LMO47dg" x="236" y="376"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Bl1NBKwpEeGqBf0LMO47dg" x="236" y="387"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_Bl3pQKwpEeGqBf0LMO47dg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_Bl3pQ6wpEeGqBf0LMO47dg" type="4001"/>
@@ -130,7 +130,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_Bl3pQawpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//UserPassword"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Bl3pQqwpEeGqBf0LMO47dg" x="30" y="506"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Bl3pQqwpEeGqBf0LMO47dg" x="30" y="474"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_PWGq0LIPEeGyraMqKGwiUw" type="1001">
     <children xmi:type="notation:Node" xmi:id="_PWKVMLIPEeGyraMqKGwiUw" type="4001"/>
@@ -150,7 +150,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_PWGq0bIPEeGyraMqKGwiUw" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//Permission"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_PWGq0rIPEeGyraMqKGwiUw" x="470" y="372" width="183"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_PWGq0rIPEeGyraMqKGwiUw" x="480" y="383" width="183"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_Fl308LIREeGyraMqKGwiUw" type="1005">
     <children xmi:type="notation:Node" xmi:id="_Fl64QLIREeGyraMqKGwiUw" type="4010"/>
@@ -169,7 +169,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_Fl4cALIREeGyraMqKGwiUw" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EEnum" href="security.ecore#//Access"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Fl4cAbIREeGyraMqKGwiUw" x="718" y="361" width="132"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_Fl4cAbIREeGyraMqKGwiUw" x="733" y="372" width="132"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_x3ZpwLIREeGyraMqKGwiUw" type="1001">
     <eAnnotations xmi:type="ecore:EAnnotation" xmi:id="_x4HbcLIREeGyraMqKGwiUw" source="Shortcut">
@@ -188,7 +188,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_x3ZpwbIREeGyraMqKGwiUw" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EClass"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_x3ZpwrIREeGyraMqKGwiUw" x="414" y="608"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_x3ZpwrIREeGyraMqKGwiUw" x="345" y="785"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_2OPHILIREeGyraMqKGwiUw" type="1001">
     <eAnnotations xmi:type="ecore:EAnnotation" xmi:id="_2Om6kLIREeGyraMqKGwiUw" source="Shortcut">
@@ -207,7 +207,7 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_2OPHIbIREeGyraMqKGwiUw" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="platform:/plugin/org.eclipse.emf.ecore/model/Ecore.ecore#//EPackage"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_2OPHIrIREeGyraMqKGwiUw" x="270" y="608"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_2OPHIrIREeGyraMqKGwiUw" x="180" y="785" width="116"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_UsS9ILRkEeG4L6jPmHyTfg" visible="false" type="1004">
     <children xmi:type="notation:Node" xmi:id="_UsWAcLRkEeG4L6jPmHyTfg" type="4008"/>
@@ -216,38 +216,6 @@
     <element xmi:type="ecore:EDataType" href="security.ecore#//AccessObject"/>
     <layoutConstraint xmi:type="notation:Bounds" xmi:id="_UsS9IrRkEeG4L6jPmHyTfg" x="524" y="18" width="337"/>
   </children>
-  <children xmi:type="notation:Node" xmi:id="__E7kYbRpEeGKL-Elp-YnkA" type="1001">
-    <children xmi:type="notation:Node" xmi:id="__E9ZkLRpEeGKL-Elp-YnkA" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="__E9ZkbRpEeGKL-Elp-YnkA" type="5001">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="__E9ZkrRpEeGKL-Elp-YnkA"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="__E9Zk7RpEeGKL-Elp-YnkA"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="__E9ZlLRpEeGKL-Elp-YnkA"/>
-    </children>
-    <children xmi:type="notation:Node" xmi:id="__E-AoLRpEeGKL-Elp-YnkA" type="5002">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="__E-AobRpEeGKL-Elp-YnkA"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="__E-AorRpEeGKL-Elp-YnkA"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="__E-Ao7RpEeGKL-Elp-YnkA"/>
-    </children>
-    <styles xmi:type="notation:ShapeStyle" xmi:id="__E7kYrRpEeGKL-Elp-YnkA" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
-    <element xmi:type="ecore:EClass" href="security.ecore#//PackagePermission"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="__E7kY7RpEeGKL-Elp-YnkA" x="250" y="510" width="141"/>
-  </children>
-  <children xmi:type="notation:Node" xmi:id="_6qkZcbSLEeGXB8zr6LLorg" type="1001">
-    <children xmi:type="notation:Node" xmi:id="_6qp5ALSLEeGXB8zr6LLorg" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="_6qrHILSLEeGXB8zr6LLorg" type="5001">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="_6qrHIbSLEeGXB8zr6LLorg"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="_6qrHIrSLEeGXB8zr6LLorg"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="_6qrHI7SLEeGXB8zr6LLorg"/>
-    </children>
-    <children xmi:type="notation:Node" xmi:id="_6qruMLSLEeGXB8zr6LLorg" type="5002">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="_6qruMbSLEeGXB8zr6LLorg"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="_6qruMrSLEeGXB8zr6LLorg"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="_6qruM7SLEeGXB8zr6LLorg"/>
-    </children>
-    <styles xmi:type="notation:ShapeStyle" xmi:id="_6qkZcrSLEeGXB8zr6LLorg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
-    <element xmi:type="ecore:EClass" href="security.ecore#//ClassPermission"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_6qkZc7SLEeGXB8zr6LLorg" x="403" y="510" width="124"/>
-  </children>
   <children xmi:type="notation:Node" xmi:id="_7gy20LSLEeGXB8zr6LLorg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_7g0sALSLEeGXB8zr6LLorg" type="4001"/>
     <children xmi:type="notation:Node" xmi:id="_7g1TELSLEeGXB8zr6LLorg" type="5001">
@@ -262,55 +230,273 @@
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_7gy20bSLEeGXB8zr6LLorg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//Realm"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_7gy20rSLEeGXB8zr6LLorg" x="427" y="139"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_7gy20rSLEeGXB8zr6LLorg" x="427" y="124"/>
   </children>
   <children xmi:type="notation:Node" xmi:id="_8vHrILSLEeGXB8zr6LLorg" type="1001">
     <children xmi:type="notation:Node" xmi:id="_8vISMLSLEeGXB8zr6LLorg" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="_8vISMbSLEeGXB8zr6LLorg" type="5001">
+    <children xmi:type="notation:Node" xmi:id="_8vISMbSLEeGXB8zr6LLorg" visible="false" type="5001">
       <styles xmi:type="notation:DrawerStyle" xmi:id="_8vISMrSLEeGXB8zr6LLorg"/>
       <styles xmi:type="notation:SortingStyle" xmi:id="_8vISM7SLEeGXB8zr6LLorg"/>
       <styles xmi:type="notation:FilteringStyle" xmi:id="_8vISNLSLEeGXB8zr6LLorg"/>
     </children>
-    <children xmi:type="notation:Node" xmi:id="_8vISNbSLEeGXB8zr6LLorg" type="5002">
+    <children xmi:type="notation:Node" xmi:id="_8vISNbSLEeGXB8zr6LLorg" visible="false" type="5002">
       <styles xmi:type="notation:DrawerStyle" xmi:id="_8vISNrSLEeGXB8zr6LLorg"/>
       <styles xmi:type="notation:SortingStyle" xmi:id="_8vISN7SLEeGXB8zr6LLorg"/>
       <styles xmi:type="notation:FilteringStyle" xmi:id="_8vISOLSLEeGXB8zr6LLorg"/>
     </children>
     <styles xmi:type="notation:ShapeStyle" xmi:id="_8vHrIbSLEeGXB8zr6LLorg" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
     <element xmi:type="ecore:EClass" href="security.ecore#//User"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_8vHrIrSLEeGXB8zr6LLorg" x="50" y="376"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_8vHrIrSLEeGXB8zr6LLorg" x="50" y="387"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_DR9foB7pEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_DR_U0B7pEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_DR_U0R7pEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_DR_U0h7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_DR_U0x7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_DR_U1B7pEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_DR_74B7pEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_DR_74R7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_DR_74h7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_DR_74x7pEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_DR9foR7pEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//ExpressionFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_DR9foh7pEeOJ3sK94Szb0A" x="507" y="785" width="131"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_d7yd8B7pEeOJ3sK94Szb0A" type="1001">
+    <eAnnotations xmi:type="ecore:EAnnotation" xmi:id="_d8khEB7pEeOJ3sK94Szb0A" source="Shortcut">
+      <details xmi:type="ecore:EStringToStringMapEntry" xmi:id="_d8khER7pEeOJ3sK94Szb0A" key="modelID" value="EcoreTools"/>
+    </eAnnotations>
+    <children xmi:type="notation:Node" xmi:id="_d7zsEB7pEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_d70TIB7pEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_d70TIR7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_d70TIh7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_d70TIx7pEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_d70TJB7pEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_d70TJR7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_d70TJh7pEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_d70TJx7pEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_d7yd8R7pEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="platform:/resource/org.eclipse.emf.cdo.expressions/model/expressions.ecore#//Expression"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_d7yd8h7pEeOJ3sK94Szb0A" x="505" y="859" width="133"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_maNXIB9qEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_maN-MB9qEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_maOlQB9qEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_maOlQR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_maOlQh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_maOlQx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_maOlRB9qEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_maOlRR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_maOlRh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_maOlRx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_maNXIR9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//FilterPermission"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_maNXIh9qEeOJ3sK94Szb0A" x="495" y="480" width="150"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_tMuMwB9qEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_tMva4B9qEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_tMwB8B9qEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_tMwB8R9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_tMwB8h9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_tMwB8x9qEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_tMwpAB9qEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_tMwpAR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_tMwpAh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_tMwpAx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_tMuMwR9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//PermissionFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_tMuMwh9qEeOJ3sK94Szb0A" x="507" y="565" width="126"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_4Ce1YB9qEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_4CgDgB9qEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_4CgDgR9qEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_4CgDgh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_4CgDgx9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_4CgDhB9qEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_4CgqkB9qEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_4CgqkR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_4Cgqkh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_4Cgqkx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_4Ce1YR9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//PackageFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_4Ce1Yh9qEeOJ3sK94Szb0A" x="185" y="665"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_5GR0sB9qEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_5GTp4B9qEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_5GTp4R9qEeOJ3sK94Szb0A" type="5001">
+      <children xmi:type="notation:Node" xmi:id="_ZmpIwB-QEeOVLL3OCGcAvw" type="2001">
+        <element xmi:type="ecore:EAttribute" href="security.ecore#//ClassFilter/subTypes"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_ZmpIwR-QEeOVLL3OCGcAvw"/>
+      </children>
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_5GTp4h9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_5GTp4x9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_5GTp5B9qEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_5GUQ8B9qEeOJ3sK94Szb0A" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_5GUQ8R9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_5GUQ8h9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_5GUQ8x9qEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_5GR0sR9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//ClassFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_5GR0sh9qEeOJ3sK94Szb0A" x="320" y="665"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_6LfJQB9qEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_6LgXYB9qEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_6Lg-cB9qEeOJ3sK94Szb0A" type="5001">
+      <children xmi:type="notation:Node" xmi:id="_YxhecB9rEeOJ3sK94Szb0A" type="2001">
+        <element xmi:type="ecore:EAttribute" href="security.ecore#//ResourceFilter/path"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_YxhecR9rEeOJ3sK94Szb0A"/>
+      </children>
+      <children xmi:type="notation:Node" xmi:id="_OEBegB-uEeOVLL3OCGcAvw" type="2001">
+        <element xmi:type="ecore:EAttribute" href="security.ecore#//ResourceFilter/inclusion"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_OEBegR-uEeOVLL3OCGcAvw"/>
+      </children>
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_6Lg-cR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_6Lg-ch9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_6Lg-cx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_6LhlgB9qEeOJ3sK94Szb0A" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_6LhlgR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_6Lhlgh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_6Lhlgx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_6LfJQR9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//ResourceFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_6LfJQh9qEeOJ3sK94Szb0A" x="655" y="665"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_7qI4kB9qEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_7qKGsB9qEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_7qKtwB9qEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_7qKtwR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_7qKtwh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_7qKtwx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_7qKtxB9qEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_7qKtxR9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_7qKtxh9qEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_7qKtxx9qEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_7qI4kR9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//ObjectFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_7qI4kh9qEeOJ3sK94Szb0A" x="502" y="665" width="136"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_HmsxMB9rEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_HmtYQB9rEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_HmtYQR9rEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_HmtYQh9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_HmtYQx9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_HmtYRB9rEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_Hmt_UB9rEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_Hmt_UR9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_Hmt_Uh9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_Hmt_Ux9rEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_HmsxMR9rEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//AndFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_HmsxMh9rEeOJ3sK94Szb0A" x="836" y="785"/>
   </children>
-  <children xmi:type="notation:Node" xmi:id="_lcyeYP4cEeGpopUAItL9cQ" type="1001">
-    <children xmi:type="notation:Node" xmi:id="_lc2v0P4cEeGpopUAItL9cQ" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="_lc398P4cEeGpopUAItL9cQ" type="5001">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="_lc4lAP4cEeGpopUAItL9cQ"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="_lc4lAf4cEeGpopUAItL9cQ"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="_lc4lAv4cEeGpopUAItL9cQ"/>
-    </children>
-    <children xmi:type="notation:Node" xmi:id="_lc5zIP4cEeGpopUAItL9cQ" type="5002">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="_lc5zIf4cEeGpopUAItL9cQ"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="_lc5zIv4cEeGpopUAItL9cQ"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="_lc5zI_4cEeGpopUAItL9cQ"/>
-    </children>
-    <styles xmi:type="notation:ShapeStyle" xmi:id="_lcyeYf4cEeGpopUAItL9cQ" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
-    <element xmi:type="ecore:EClass" href="security.ecore#//ResourcePermission"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_lcyeYv4cEeGpopUAItL9cQ" x="545" y="510" width="148"/>
+  <children xmi:type="notation:Node" xmi:id="_JtuvIB9rEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_JtwkUB9rEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_JtwkUR9rEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_JtwkUh9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_JtwkUx9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_JtwkVB9rEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_JtxLYB9rEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_JtxLYR9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_JtxLYh9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_JtxLYx9rEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_JtuvIR9rEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//NotFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_JtuvIh9rEeOJ3sK94Szb0A" x="721" y="785"/>
   </children>
-  <children xmi:type="notation:Node" xmi:id="_-P7GUaA6EeKe8MpC3pr_IA" type="1001">
-    <children xmi:type="notation:Node" xmi:id="_-P87gKA6EeKe8MpC3pr_IA" type="4001"/>
-    <children xmi:type="notation:Node" xmi:id="_-P9ikKA6EeKe8MpC3pr_IA" type="5001">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="_-P9ikaA6EeKe8MpC3pr_IA"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="_-P9ikqA6EeKe8MpC3pr_IA"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="_-P9ik6A6EeKe8MpC3pr_IA"/>
-    </children>
-    <children xmi:type="notation:Node" xmi:id="_-P9ilKA6EeKe8MpC3pr_IA" type="5002">
-      <styles xmi:type="notation:DrawerStyle" xmi:id="_-P9ilaA6EeKe8MpC3pr_IA"/>
-      <styles xmi:type="notation:SortingStyle" xmi:id="_-P9ilqA6EeKe8MpC3pr_IA"/>
-      <styles xmi:type="notation:FilteringStyle" xmi:id="_-P9il6A6EeKe8MpC3pr_IA"/>
-    </children>
-    <styles xmi:type="notation:ShapeStyle" xmi:id="_-P7GUqA6EeKe8MpC3pr_IA" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
-    <element xmi:type="ecore:EClass" href="security.ecore#//ObjectPermission"/>
-    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_-P7GU6A6EeKe8MpC3pr_IA" x="715" y="510" width="138"/>
+  <children xmi:type="notation:Node" xmi:id="_KyDS4B9rEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_KyEhAB9rEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_KyFIEB9rEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_KyFIER9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_KyFIEh9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_KyFIEx9rEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_KyFvIB9rEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_KyFvIR9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_KyFvIh9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_KyFvIx9rEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_KyDS4R9rEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//OrFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_KyDS4h9rEeOJ3sK94Szb0A" x="956" y="785"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_LwMWIB9rEeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_LwNkQB9rEeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_LwNkQR9rEeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_LwOLUB9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_LwOLUR9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_LwOLUh9rEeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_LwOLUx9rEeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_LwOLVB9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_LwOLVR9rEeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_LwOLVh9rEeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_LwMWIR9rEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//CombinedFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_LwMWIh9rEeOJ3sK94Szb0A" x="820" y="665" width="124"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_lCpCEB98EeOJ3sK94Szb0A" type="1001">
+    <children xmi:type="notation:Node" xmi:id="_lCppIB98EeOJ3sK94Szb0A" type="4001"/>
+    <children xmi:type="notation:Node" xmi:id="_lCppIR98EeOJ3sK94Szb0A" visible="false" type="5001">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_lCppIh98EeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_lCppIx98EeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_lCppJB98EeOJ3sK94Szb0A"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_lCppJR98EeOJ3sK94Szb0A" visible="false" type="5002">
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_lCppJh98EeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_lCppJx98EeOJ3sK94Szb0A"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_lCppKB98EeOJ3sK94Szb0A"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_lCpCER98EeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EClass" href="security.ecore#//LinkedFilter"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_lCpCEh98EeOJ3sK94Szb0A" x="50" y="665" width="106"/>
+  </children>
+  <children xmi:type="notation:Node" xmi:id="_0XMCAB-vEeOVLL3OCGcAvw" type="1005">
+    <children xmi:type="notation:Node" xmi:id="_0XPsYB-vEeOVLL3OCGcAvw" type="4010"/>
+    <children xmi:type="notation:Node" xmi:id="_0XQ6gB-vEeOVLL3OCGcAvw" type="5008">
+      <children xmi:type="notation:Node" xmi:id="_9DwwkB-vEeOVLL3OCGcAvw" type="2006">
+        <element xmi:type="ecore:EEnumLiteral" href="security.ecore#//Inclusion/Exact"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_9DwwkR-vEeOVLL3OCGcAvw"/>
+      </children>
+      <children xmi:type="notation:Node" xmi:id="_46LFAB-vEeOVLL3OCGcAvw" type="2006">
+        <element xmi:type="ecore:EEnumLiteral" href="security.ecore#//Inclusion/ExactAndUp"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_46LFAR-vEeOVLL3OCGcAvw"/>
+      </children>
+      <children xmi:type="notation:Node" xmi:id="_7nx6wB-vEeOVLL3OCGcAvw" type="2006">
+        <element xmi:type="ecore:EEnumLiteral" href="security.ecore#//Inclusion/ExactAndDown"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_7nx6wR-vEeOVLL3OCGcAvw"/>
+      </children>
+      <children xmi:type="notation:Node" xmi:id="_NKZVkB-zEeOVLL3OCGcAvw" type="2006">
+        <element xmi:type="ecore:EEnumLiteral" href="security.ecore#//Inclusion/Regex"/>
+        <layoutConstraint xmi:type="notation:Location" xmi:id="_NKZVkR-zEeOVLL3OCGcAvw"/>
+      </children>
+      <styles xmi:type="notation:DrawerStyle" xmi:id="_0XQ6gR-vEeOVLL3OCGcAvw"/>
+      <styles xmi:type="notation:SortingStyle" xmi:id="_0XQ6gh-vEeOVLL3OCGcAvw"/>
+      <styles xmi:type="notation:FilteringStyle" xmi:id="_0XQ6gx-vEeOVLL3OCGcAvw"/>
+    </children>
+    <styles xmi:type="notation:ShapeStyle" xmi:id="_0XMCAR-vEeOVLL3OCGcAvw" fontColor="4210752" fontName="Segoe UI" fontHeight="10" fillColor="13761016" lineColor="8421504"/>
+    <element xmi:type="ecore:EEnum" href="security.ecore#//Inclusion"/>
+    <layoutConstraint xmi:type="notation:Bounds" xmi:id="_0XMCAh-vEeOVLL3OCGcAvw" x="740" y="460" width="118"/>
   </children>
   <styles xmi:type="notation:DiagramStyle" xmi:id="_BlsqIawpEeGqBf0LMO47dg"/>
   <element xmi:type="ecore:EPackage" href="security.ecore#/"/>
@@ -318,21 +504,21 @@
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_Bl4QUawpEeGqBf0LMO47dg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_Bl4QUqwpEeGqBf0LMO47dg" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl4QU6wpEeGqBf0LMO47dg" points="[-1, 0, -59, 67]$[-1, -26, -59, 41]$[93, -26, 35, 41]$[93, -67, 35, 0]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl4QU6wpEeGqBf0LMO47dg" points="[-1, 0, -74, 52]$[-1, -21, -74, 31]$[108, -21, 35, 31]$[108, -52, 35, 0]"/>
     <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm4V4awpEeGqBf0LMO47dg" id="(0.5,0.0)"/>
     <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm4V4qwpEeGqBf0LMO47dg" id="(0.24647887323943662,1.0)"/>
   </edges>
   <edges xmi:type="notation:Edge" xmi:id="_Bl43ZKwpEeGqBf0LMO47dg" type="3002" source="_BlywyqwpEeGqBf0LMO47dg" target="_BlxioqwpEeGqBf0LMO47dg">
     <children xmi:type="notation:Node" xmi:id="_Bl5ecKwpEeGqBf0LMO47dg" type="4011">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_Bl5ecawpEeGqBf0LMO47dg" x="31" y="-12"/>
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_Bl5ecawpEeGqBf0LMO47dg" x="21" y="-10"/>
     </children>
     <children xmi:type="notation:Node" xmi:id="_Bl5ecqwpEeGqBf0LMO47dg" type="4012">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_Bl5ec6wpEeGqBf0LMO47dg" x="39" y="13"/>
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_Bl5ec6wpEeGqBf0LMO47dg" x="25" y="11"/>
     </children>
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_Bl43ZawpEeGqBf0LMO47dg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_Bl43ZqwpEeGqBf0LMO47dg" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
     <element xmi:type="ecore:EReference" href="security.ecore#//Directory/items"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl43Z6wpEeGqBf0LMO47dg" points="[-37, 25, -155, 93]$[-84, 25, -202, 93]$[-84, -89, -202, -21]$[102, -89, -16, -21]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl43Z6wpEeGqBf0LMO47dg" points="[-37, 29, -155, 126]$[-69, 29, -187, 126]$[-69, -117, -187, -20]$[102, -117, -16, -20]"/>
     <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm488KwpEeGqBf0LMO47dg" id="(0.33043478260869563,0.0)"/>
     <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm488awpEeGqBf0LMO47dg" id="(0.16666666666666666,1.0)"/>
   </edges>
@@ -340,7 +526,7 @@
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_Bl6FgawpEeGqBf0LMO47dg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_Bl6FgqwpEeGqBf0LMO47dg" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl6Fg6wpEeGqBf0LMO47dg" points="[-18, 0, -116, 68]$[-18, -25, -116, 43]$[114, -25, 16, 43]$[114, -68, 16, 0]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl6Fg6wpEeGqBf0LMO47dg" points="[-18, 0, -116, 97]$[-18, -31, -116, 66]$[114, -31, 16, 66]$[114, -97, 16, 0]"/>
     <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm488qwpEeGqBf0LMO47dg" id="(0.6608695652173913,0.0)"/>
     <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm4886wpEeGqBf0LMO47dg" id="(0.3333333333333333,1.0)"/>
   </edges>
@@ -362,7 +548,7 @@
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_Bl6skawpEeGqBf0LMO47dg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_Bl6skqwpEeGqBf0LMO47dg" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl6sk6wpEeGqBf0LMO47dg" points="[-16, 0, 259, 68]$[-16, -25, 259, 43]$[-276, -25, -1, 43]$[-276, -68, -1, 0]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_Bl6sk6wpEeGqBf0LMO47dg" points="[-4, 0, 282, 97]$[-4, -31, 282, 66]$[-287, -31, -1, 66]$[-287, -97, -1, 0]"/>
     <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm8nUKwpEeGqBf0LMO47dg" id="(0.5,0.0)"/>
     <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Bm8nUawpEeGqBf0LMO47dg" id="(0.5,1.0)"/>
   </edges>
@@ -434,77 +620,41 @@
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_pKXTEbIPEeGyraMqKGwiUw" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_pKXTErIPEeGyraMqKGwiUw" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
     <element xmi:type="ecore:EReference" href="security.ecore#//Role/permissions"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_pKXTE7IPEeGyraMqKGwiUw" points="[39, 39, 0, -102]$[39, 117, 0, -24]"/>
-    <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_gnbM8BcWEeOAzaHqTTuVhg" id="(0.10784313725490197,0.21568627450980393)"/>
-    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_gnbM8RcWEeOAzaHqTTuVhg" id="(0.5,0.5)"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_pKXTE7IPEeGyraMqKGwiUw" points="[38, 39, 0, -102]$[38, 117, 0, -24]"/>
+    <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_2LxvoB-wEeOVLL3OCGcAvw" id="(0.10784313725490197,0.21568627450980393)"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_2LyWsB-wEeOVLL3OCGcAvw" id="(0.5,0.5)"/>
   </edges>
   <edges xmi:type="notation:Edge" xmi:id="_s4d8gLIPEeGyraMqKGwiUw" type="3002" source="_PWGq0LIPEeGyraMqKGwiUw" target="_BlzX26wpEeGqBf0LMO47dg">
     <children xmi:type="notation:Node" xmi:id="_s4fxsLIPEeGyraMqKGwiUw" type="4011">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_s4fxsbIPEeGyraMqKGwiUw" x="-2" y="-23"/>
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_s4fxsbIPEeGyraMqKGwiUw" x="-7" y="-24"/>
     </children>
     <children xmi:type="notation:Node" xmi:id="_s4gYwLIPEeGyraMqKGwiUw" type="4012">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_s4gYwbIPEeGyraMqKGwiUw" x="1" y="12"/>
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_s4gYwbIPEeGyraMqKGwiUw" x="-7" y="18"/>
     </children>
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_s4d8gbIPEeGyraMqKGwiUw" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_s4ejkLIPEeGyraMqKGwiUw" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
     <element xmi:type="ecore:EReference" href="security.ecore#//Permission/role"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_s4ejkbIPEeGyraMqKGwiUw" points="[0, -24, 39, 117]$[0, -102, 39, 39]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_s4ejkbIPEeGyraMqKGwiUw" points="[0, -24, 38, 117]$[0, -102, 38, 39]"/>
     <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_KDoVVLRkEeG4L6jPmHyTfg" id="(0.5,0.5)"/>
     <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_KDo8YLRkEeG4L6jPmHyTfg" id="(0.10784313725490197,0.21568627450980393)"/>
   </edges>
-  <edges xmi:type="notation:Edge" xmi:id="__FJm0LRpEeGKL-Elp-YnkA" type="3002" source="__E7kYbRpEeGKL-Elp-YnkA" target="_2OPHILIREeGyraMqKGwiUw">
-    <children xmi:type="notation:Node" xmi:id="__FKN4LRpEeGKL-Elp-YnkA" type="4011">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="__FKN4bRpEeGKL-Elp-YnkA" x="-13" y="-60"/>
-    </children>
-    <children xmi:type="notation:Node" xmi:id="__FKN4rRpEeGKL-Elp-YnkA" type="4012">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="__FKN47RpEeGKL-Elp-YnkA" x="-13" y="8"/>
-    </children>
-    <styles xmi:type="notation:ConnectorStyle" xmi:id="__FJm0bRpEeGKL-Elp-YnkA" routing="Rectilinear" lineColor="4210752"/>
-    <styles xmi:type="notation:FontStyle" xmi:id="__FJm0rRpEeGKL-Elp-YnkA" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
-    <element xmi:type="ecore:EReference" href="security.ecore#//PackagePermission/applicablePackage"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="__FJm07RpEeGKL-Elp-YnkA" points="[0, 21, -1, -76]$[0, 78, -1, -19]"/>
-  </edges>
-  <edges xmi:type="notation:Edge" xmi:id="__FLcALRpEeGKL-Elp-YnkA" type="3003" source="__E7kYbRpEeGKL-Elp-YnkA" target="_PWGq0LIPEeGyraMqKGwiUw">
-    <styles xmi:type="notation:ConnectorStyle" xmi:id="__FLcAbRpEeGKL-Elp-YnkA" routing="Rectilinear" lineColor="4210752"/>
-    <styles xmi:type="notation:FontStyle" xmi:id="__FLcArRpEeGKL-Elp-YnkA" fontName="Segoe UI"/>
-    <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="__FLcA7RpEeGKL-Elp-YnkA" points="[0, -20, -241, 114]$[0, -45, -241, 89]$[241, -45, 0, 89]$[241, -109, 0, 25]"/>
-  </edges>
-  <edges xmi:type="notation:Edge" xmi:id="_6q2tULSLEeGXB8zr6LLorg" type="3002" source="_6qkZcbSLEeGXB8zr6LLorg" target="_x3ZpwLIREeGyraMqKGwiUw">
-    <children xmi:type="notation:Node" xmi:id="_6q37cLSLEeGXB8zr6LLorg" type="4011">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_6q37cbSLEeGXB8zr6LLorg" x="-13" y="-52"/>
-    </children>
-    <children xmi:type="notation:Node" xmi:id="_6q37crSLEeGXB8zr6LLorg" type="4012">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_6q37c7SLEeGXB8zr6LLorg" x="-13" y="9"/>
-    </children>
-    <styles xmi:type="notation:ConnectorStyle" xmi:id="_6q2tUbSLEeGXB8zr6LLorg" routing="Rectilinear" lineColor="4210752"/>
-    <styles xmi:type="notation:FontStyle" xmi:id="_6q2tUrSLEeGXB8zr6LLorg" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
-    <element xmi:type="ecore:EReference" href="security.ecore#//ClassPermission/applicableClass"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_6q2tU7SLEeGXB8zr6LLorg" points="[-1, 21, -1, -76]$[-1, 78, -1, -19]"/>
-  </edges>
-  <edges xmi:type="notation:Edge" xmi:id="_6q5JkLSLEeGXB8zr6LLorg" type="3003" source="_6qkZcbSLEeGXB8zr6LLorg" target="_PWGq0LIPEeGyraMqKGwiUw">
-    <styles xmi:type="notation:ConnectorStyle" xmi:id="_6q5JkbSLEeGXB8zr6LLorg" routing="Rectilinear" lineColor="4210752"/>
-    <styles xmi:type="notation:FontStyle" xmi:id="_6q5JkrSLEeGXB8zr6LLorg" fontName="Segoe UI"/>
-    <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_6q5Jk7SLEeGXB8zr6LLorg" points="[1, -20, -95, 114]$[1, -45, -95, 89]$[96, -45, 0, 89]$[96, -109, 0, 25]"/>
-  </edges>
   <edges xmi:type="notation:Edge" xmi:id="_7hI1ELSLEeGXB8zr6LLorg" type="3002" source="_7gy20LSLEeGXB8zr6LLorg" target="_BlxioqwpEeGqBf0LMO47dg">
     <children xmi:type="notation:Node" xmi:id="_7hJcILSLEeGXB8zr6LLorg" type="4011">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_7hJcIbSLEeGXB8zr6LLorg" x="-10" y="-10"/>
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_7hJcIbSLEeGXB8zr6LLorg" x="-15" y="-11"/>
     </children>
     <children xmi:type="notation:Node" xmi:id="_7hJcIrSLEeGXB8zr6LLorg" type="4012">
-      <layoutConstraint xmi:type="notation:Location" xmi:id="_7hJcI7SLEeGXB8zr6LLorg" x="-4" y="10"/>
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_7hJcI7SLEeGXB8zr6LLorg" x="-9" y="10"/>
     </children>
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_7hI1EbSLEeGXB8zr6LLorg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_7hI1ErSLEeGXB8zr6LLorg" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
     <element xmi:type="ecore:EReference" href="security.ecore#//Realm/items"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_7hI1E7SLEeGXB8zr6LLorg" points="[-50, -3, 141, 0]$[-141, -3, 50, 0]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_7hI1E7SLEeGXB8zr6LLorg" points="[-50, -5, 141, -1]$[-141, -5, 50, -1]"/>
   </edges>
   <edges xmi:type="notation:Edge" xmi:id="_7hNGgLSLEeGXB8zr6LLorg" type="3003" source="_7gy20LSLEeGXB8zr6LLorg" target="_BlvtcKwpEeGqBf0LMO47dg">
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_7hNGgbSLEeGXB8zr6LLorg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_7hNGgrSLEeGXB8zr6LLorg" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_7hNGg7SLEeGXB8zr6LLorg" points="[0, -20, 97, 95]$[0, -49, 97, 66]$[-98, -49, -1, 66]$[-98, -90, -1, 25]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_7hNGg7SLEeGXB8zr6LLorg" points="[5, -20, 87, 80]$[5, -44, 87, 56]$[-83, -44, -1, 56]$[-83, -75, -1, 25]"/>
   </edges>
   <edges xmi:type="notation:Edge" xmi:id="_8vTRULSLEeGXB8zr6LLorg" type="3002" source="_8vHrILSLEeGXB8zr6LLorg" target="_Bl1NAqwpEeGqBf0LMO47dg">
     <children xmi:type="notation:Node" xmi:id="_8vTRVLSLEeGXB8zr6LLorg" type="4011">
@@ -536,7 +686,7 @@
     <styles xmi:type="notation:ConnectorStyle" xmi:id="_8vYw4bSLEeGXB8zr6LLorg" routing="Rectilinear" lineColor="4210752"/>
     <styles xmi:type="notation:FontStyle" xmi:id="_8vYw4rSLEeGXB8zr6LLorg" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_8vYw47SLEeGXB8zr6LLorg" points="[18, -20, -168, 107]$[18, -46, -168, 81]$[185, -46, -1, 81]$[185, -102, -1, 25]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_8vYw47SLEeGXB8zr6LLorg" points="[1, -19, -185, 107]$[1, -46, -185, 80]$[185, -46, -1, 80]$[185, -101, -1, 25]"/>
   </edges>
   <edges xmi:type="notation:Edge" xmi:id="_8vamELSLEeGXB8zr6LLorg" type="3002" source="_Bl1NAqwpEeGqBf0LMO47dg" target="_8vHrILSLEeGXB8zr6LLorg">
     <children xmi:type="notation:Node" xmi:id="_8vbNIbSLEeGXB8zr6LLorg" type="4011">
@@ -552,16 +702,153 @@
     <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Lk1o8P4cEeGpopUAItL9cQ" id="(0.5,0.5)"/>
     <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_Lk1o8f4cEeGpopUAItL9cQ" id="(0.5,0.5)"/>
   </edges>
-  <edges xmi:type="notation:Edge" xmi:id="_ldPKUP4cEeGpopUAItL9cQ" type="3003" source="_lcyeYP4cEeGpopUAItL9cQ" target="_PWGq0LIPEeGyraMqKGwiUw">
-    <styles xmi:type="notation:ConnectorStyle" xmi:id="_ldPKUf4cEeGpopUAItL9cQ" routing="Rectilinear" lineColor="4210752"/>
-    <styles xmi:type="notation:FontStyle" xmi:id="_ldPKUv4cEeGpopUAItL9cQ" fontName="Segoe UI"/>
+  <edges xmi:type="notation:Edge" xmi:id="_5Ak58B7pEeOJ3sK94Szb0A" type="3002" source="_DR9foB7pEeOJ3sK94Szb0A" target="_d7yd8B7pEeOJ3sK94Szb0A">
+    <children xmi:type="notation:Node" xmi:id="_5AlhAB7pEeOJ3sK94Szb0A" type="4011">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_5AlhAR7pEeOJ3sK94Szb0A" x="-11" y="-38"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_5AlhAh7pEeOJ3sK94Szb0A" type="4012">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_5AlhAx7pEeOJ3sK94Szb0A" x="-11" y="14"/>
+    </children>
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_5Ak58R7pEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_5Ak58h7pEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
+    <element xmi:type="ecore:EReference" href="security.ecore#//ExpressionFilter/expression"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_5Ak58x7pEeOJ3sK94Szb0A" points="[7, 21, 2, -49]$[7, 64, 2, -6]"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_5AnWMB7pEeOJ3sK94Szb0A" id="(0.5413533834586466,0.175)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_AaaOQB7qEeOJ3sK94Szb0A" type="3003" source="_DR9foB7pEeOJ3sK94Szb0A" target="_7qI4kB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_AaaOQR7qEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_AaaOQh7qEeOJ3sK94Szb0A" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_ldPKU_4cEeGpopUAItL9cQ" points="[-1, -20, 57, 114]$[-1, -45, 57, 89]$[-58, -45, 0, 89]$[-58, -109, 0, 25]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_AaaOQx7qEeOJ3sK94Szb0A" points="[1, -20, 1, 77]$[1, -78, 1, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_OEFpMB9cEeOJ3sK94Szb0A" type="3002" source="_LwMWIB9rEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <children xmi:type="notation:Node" xmi:id="_OEG3UB9cEeOJ3sK94Szb0A" type="4011">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_OEG3UR9cEeOJ3sK94Szb0A" x="32" y="10"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_OEG3Uh9cEeOJ3sK94Szb0A" type="4012">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_OEG3Ux9cEeOJ3sK94Szb0A" x="51" y="-11"/>
+    </children>
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_OEFpMR9cEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_OEFpMh9cEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
+    <element xmi:type="ecore:EReference" href="security.ecore#//CombinedFilter/operands"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_OEGQQB9cEeOJ3sK94Szb0A" points="[58, 16, 326, 101]$[91, 16, 359, 101]$[91, -86, 359, -1]$[-253, -86, 15, -1]"/>
+    <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_qcz0cB9rEeOJ3sK94Szb0A" id="(0.5283018867924528,0.11627906976744186)"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_OELv0B9cEeOJ3sK94Szb0A" id="(0.8809523809523809,0.525)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_0CDs4B9qEeOJ3sK94Szb0A" type="3002" source="_maNXIB9qEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <children xmi:type="notation:Node" xmi:id="_0CDs5B9qEeOJ3sK94Szb0A" type="4011">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_0CDs5R9qEeOJ3sK94Szb0A" x="-10" y="-20"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_0CDs5h9qEeOJ3sK94Szb0A" type="4012">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_0CDs5x9qEeOJ3sK94Szb0A" x="-10" y="14"/>
+    </children>
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_0CDs4R9qEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_0CDs4h9qEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
+    <element xmi:type="ecore:EReference" href="security.ecore#//FilterPermission/filters"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_0CDs4x9qEeOJ3sK94Szb0A" points="[2, 19, 2, -66]$[2, 66, 2, -19]"/>
   </edges>
-  <edges xmi:type="notation:Edge" xmi:id="_GfCc0KA7EeKe8MpC3pr_IA" type="3003" source="_-P7GUaA6EeKe8MpC3pr_IA" target="_PWGq0LIPEeGyraMqKGwiUw">
-    <styles xmi:type="notation:ConnectorStyle" xmi:id="_GfCc0aA7EeKe8MpC3pr_IA" routing="Rectilinear" lineColor="4210752"/>
-    <styles xmi:type="notation:FontStyle" xmi:id="_GfCc0qA7EeKe8MpC3pr_IA" fontName="Segoe UI"/>
+  <edges xmi:type="notation:Edge" xmi:id="_QuqbQB9rEeOJ3sK94Szb0A" type="3003" source="_HmsxMB9rEeOJ3sK94Szb0A" target="_LwMWIB9rEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_QuqbQR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_QuqbQh9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
     <element xsi:nil="true"/>
-    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_GfCc06A7EeKe8MpC3pr_IA" points="[-1, -20, 222, 114]$[-1, -45, 222, 89]$[-223, -45, 0, 89]$[-223, -109, 0, 25]"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_QuqbQx9rEeOJ3sK94Szb0A" points="[-1, -19, 1, 80]$[-1, -80, 1, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_RKYt8B9rEeOJ3sK94Szb0A" type="3003" source="_KyDS4B9rEeOJ3sK94Szb0A" target="_LwMWIB9rEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_RKYt8R9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_RKYt8h9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_RKYt8x9rEeOJ3sK94Szb0A" points="[-3, -19, 122, 101]$[-3, -44, 122, 76]$[-123, -44, 2, 76]$[-123, -101, 2, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_bRdEkB9rEeOJ3sK94Szb0A" type="3002" source="_4Ce1YB9qEeOJ3sK94Szb0A" target="_2OPHILIREeGyraMqKGwiUw">
+    <children xmi:type="notation:Node" xmi:id="_bRdroB9rEeOJ3sK94Szb0A" type="4011">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_bRdroR9rEeOJ3sK94Szb0A" x="-7" y="-58"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_bRdroh9rEeOJ3sK94Szb0A" type="4012">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_bRdrox9rEeOJ3sK94Szb0A" x="-7" y="7"/>
+    </children>
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_bRdEkR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_bRdEkh9rEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
+    <element xmi:type="ecore:EReference" href="security.ecore#//PackageFilter/applicablePackage"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_bRdEkx9rEeOJ3sK94Szb0A" points="[1, 19, -16, -94]$[1, 80, -16, -33]"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_bRgH4B9rEeOJ3sK94Szb0A" id="(0.6372549019607843,0.875)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_jvx7wB9rEeOJ3sK94Szb0A" type="3002" source="_5GR0sB9qEeOJ3sK94Szb0A" target="_x3ZpwLIREeGyraMqKGwiUw">
+    <children xmi:type="notation:Node" xmi:id="_jvyi0B9rEeOJ3sK94Szb0A" type="4011">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_jvyi0R9rEeOJ3sK94Szb0A" x="-7" y="-57"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_jvzJ4B9rEeOJ3sK94Szb0A" type="4012">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_jvzJ4R9rEeOJ3sK94Szb0A" x="-7" y="6"/>
+    </children>
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_jvx7wR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_jvx7wh9rEeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
+    <element xmi:type="ecore:EReference" href="security.ecore#//ClassFilter/applicableClass"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_jvx7wx9rEeOJ3sK94Szb0A" points="[-1, 25, -12, -77]$[-1, 96, -12, -6]"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_jv4pcB9rEeOJ3sK94Szb0A" id="(0.6176470588235294,0.175)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_w11zEB9rEeOJ3sK94Szb0A" type="3003" source="_maNXIB9qEeOJ3sK94Szb0A" target="_PWGq0LIPEeGyraMqKGwiUw">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_w11zER9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_w11zEh9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_w11zEx9rEeOJ3sK94Szb0A" points="[-3, -7, -31, 90]$[-3, -55, -31, 42]"/>
+    <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_w16EgB9rEeOJ3sK94Szb0A" id="(0.5333333333333333,0.20930232558139536)"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_w16EgR9rEeOJ3sK94Szb0A" id="(0.6721311475409836,0.1568627450980392)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_xeegYB9rEeOJ3sK94Szb0A" type="3003" source="_4Ce1YB9qEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_xeegYR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_xeegYh9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_xeegYx9rEeOJ3sK94Szb0A" points="[1, -19, -333, 81]$[1, -49, -333, 51]$[335, -49, 1, 51]$[335, -81, 1, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_x2Xb8B9rEeOJ3sK94Szb0A" type="3003" source="_5GR0sB9qEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_x2Xb8R9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_x2Xb8h9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_x2Xb8x9rEeOJ3sK94Szb0A" points="[-1, -24, -175, 81]$[-1, -54, -175, 51]$[175, -54, 1, 51]$[175, -86, 1, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_yQS-4B9rEeOJ3sK94Szb0A" type="3003" source="_6LfJQB9qEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_yQS-4R9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_yQS-4h9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_yQS-4x9rEeOJ3sK94Szb0A" points="[24, -14, 158, 81]$[24, -44, 158, 51]$[-133, -44, 1, 51]$[-133, -76, 1, 19]"/>
+    <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_yQUNAB9rEeOJ3sK94Szb0A" id="(0.344,0.21568627450980393)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_ysCfsB9rEeOJ3sK94Szb0A" type="3003" source="_7qI4kB9qEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_ysCfsR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_ysCfsh9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_ysCfsx9rEeOJ3sK94Szb0A" points="[1, -19, -32, 90]$[1, -81, -32, 28]"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_ysGxIB9rEeOJ3sK94Szb0A" id="(0.7698412698412699,0.27906976744186046)"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_1ApmoB9rEeOJ3sK94Szb0A" type="3003" source="_LwMWIB9rEeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_1ApmoR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_1Apmoh9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_1Apmox9rEeOJ3sK94Szb0A" points="[1, -19, 313, 81]$[1, -49, 313, 51]$[-311, -49, 1, 51]$[-311, -81, 1, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_2gV3wB9rEeOJ3sK94Szb0A" type="3003" source="_JtuvIB9rEeOJ3sK94Szb0A" target="_LwMWIB9rEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_2gV3wR9rEeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_2gV3wh9rEeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_2gV3wx9rEeOJ3sK94Szb0A" points="[-3, -19, -113, 101]$[-3, -44, -113, 76]$[112, -44, 2, 76]$[112, -101, 2, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_05PuYB98EeOJ3sK94Szb0A" type="3003" source="_lCpCEB98EeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_05PuYR98EeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_05PuYh98EeOJ3sK94Szb0A" fontName="Segoe UI"/>
+    <element xsi:nil="true"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_05PuYx98EeOJ3sK94Szb0A" points="[3, -19, -464, 81]$[3, -49, -464, 51]$[468, -49, 1, 51]$[468, -81, 1, 19]"/>
+  </edges>
+  <edges xmi:type="notation:Edge" xmi:id="_62wOoB98EeOJ3sK94Szb0A" type="3002" source="_lCpCEB98EeOJ3sK94Szb0A" target="_tMuMwB9qEeOJ3sK94Szb0A">
+    <children xmi:type="notation:Node" xmi:id="_62w1sB98EeOJ3sK94Szb0A" type="4011">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_62w1sR98EeOJ3sK94Szb0A" x="62" y="-10"/>
+    </children>
+    <children xmi:type="notation:Node" xmi:id="_62xcwB98EeOJ3sK94Szb0A" type="4012">
+      <layoutConstraint xmi:type="notation:Location" xmi:id="_62xcwR98EeOJ3sK94Szb0A" x="65" y="9"/>
+    </children>
+    <styles xmi:type="notation:ConnectorStyle" xmi:id="_62wOoR98EeOJ3sK94Szb0A" routing="Rectilinear" lineColor="4210752"/>
+    <styles xmi:type="notation:FontStyle" xmi:id="_62wOoh98EeOJ3sK94Szb0A" fontColor="4210752" fontName="Segoe UI" fontHeight="10"/>
+    <element xmi:type="ecore:EReference" href="security.ecore#//LinkedFilter/filter"/>
+    <bendpoints xmi:type="notation:RelativeBendpoints" xmi:id="_62wOox98EeOJ3sK94Szb0A" points="[-25, 1, -495, 106]$[-48, 1, -518, 106]$[-48, -101, -518, 4]$[442, -101, -28, 4]"/>
+    <sourceAnchor xmi:type="notation:IdentityAnchor" xmi:id="_622VQB98EeOJ3sK94Szb0A" id="(0.22413793103448276,0.525)"/>
+    <targetAnchor xmi:type="notation:IdentityAnchor" xmi:id="_622VQR98EeOJ3sK94Szb0A" id="(0.23015873015873015,0.375)"/>
   </edges>
 </notation:Diagram>
diff --git a/plugins/org.eclipse.emf.cdo.security/model/security.genmodel b/plugins/org.eclipse.emf.cdo.security/model/security.genmodel
index 9d5d02fe73..801d750c9d 100644
--- a/plugins/org.eclipse.emf.cdo.security/model/security.genmodel
+++ b/plugins/org.eclipse.emf.cdo.security/model/security.genmodel
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <genmodel:GenModel xmi:version="2.0" xmlns:xmi="http://www.omg.org/XMI" xmlns:ecore="http://www.eclipse.org/emf/2002/Ecore"
     xmlns:genmodel="http://www.eclipse.org/emf/2002/GenModel" modelDirectory="/org.eclipse.emf.cdo.security/src" creationIcons="false"
-    modelPluginID="org.eclipse.emf.cdo.security" modelName="Security" nonNLSMarkers="true"
-    rootExtendsInterface="org.eclipse.emf.cdo.CDOObject" rootExtendsClass="org.eclipse.emf.internal.cdo.CDOObjectImpl"
-    reflectiveDelegation="true" codeFormatting="true" testsDirectory="" importerID="org.eclipse.emf.importer.cdo"
+    modelPluginID="org.eclipse.emf.cdo.security" modelName="Security" updateClasspath="false"
+    nonNLSMarkers="true" rootExtendsInterface="org.eclipse.emf.cdo.CDOObject" rootExtendsClass="org.eclipse.emf.internal.cdo.CDOObjectImpl"
+    reflectiveDelegation="true" codeFormatting="true" testsDirectory="" importerID="org.eclipse.emf.importer.ecore"
     featureDelegation="Reflective" complianceLevel="5.0" copyrightFields="false" optimizedHasChildren="true"
     tableProviders="true" colorProviders="true" fontProviders="true" runtimeVersion="2.6"
-    usedGenPackages="platform:/plugin/org.eclipse.emf.ecore/model/Ecore.genmodel#//ecore ../../org.eclipse.emf.cdo/model/etypes.genmodel#//etypes">
+    usedGenPackages="platform:/plugin/org.eclipse.emf.ecore/model/Ecore.genmodel#//ecore ../../org.eclipse.emf.cdo/model/etypes.genmodel#//etypes ../../org.eclipse.emf.cdo.expressions/model/expressions.genmodel#//expressions">
   <foreignModel>security.ecore</foreignModel>
   <modelPluginVariables>CDO=org.eclipse.emf.cdo</modelPluginVariables>
   <genPackages prefix="Security" basePackage="org.eclipse.emf.cdo" disposableProviderFactory="true"
@@ -29,6 +29,9 @@
       <genFeatures property="Readonly" notify="false" createChild="false" ecoreFeature="ecore:EReference security.ecore#//Realm/allPermissions"/>
       <genFeatures createChild="false" ecoreFeature="ecore:EAttribute security.ecore#//Realm/name"/>
       <genFeatures createChild="false" ecoreFeature="ecore:EAttribute security.ecore#//Realm/defaultAccess"/>
+      <genFeatures notify="false" createChild="false" propertySortChoices="true" ecoreFeature="ecore:EReference security.ecore#//Realm/defaultUserDirectory"/>
+      <genFeatures notify="false" createChild="false" propertySortChoices="true" ecoreFeature="ecore:EReference security.ecore#//Realm/defaultGroupDirectory"/>
+      <genFeatures notify="false" createChild="false" propertySortChoices="true" ecoreFeature="ecore:EReference security.ecore#//Realm/defaultRoleDirectory"/>
     </genClasses>
     <genClasses ecoreClass="security.ecore#//Directory">
       <genFeatures property="None" children="true" createChild="true" ecoreFeature="ecore:EReference security.ecore#//Directory/items"/>
@@ -82,5 +85,33 @@
     <genClasses ecoreClass="security.ecore#//ResourcePermission">
       <genFeatures createChild="false" ecoreFeature="ecore:EAttribute security.ecore#//ResourcePermission/pattern"/>
     </genClasses>
+    <genClasses image="false" ecoreClass="security.ecore#//ObjectPermission"/>
+    <genClasses ecoreClass="security.ecore#//FilterPermission">
+      <genFeatures property="None" children="true" createChild="true" ecoreFeature="ecore:EReference security.ecore#//FilterPermission/filter"/>
+    </genClasses>
+    <genClasses image="false" ecoreClass="security.ecore#//PermissionFilter"/>
+    <genClasses ecoreClass="security.ecore#//ReferenceFilter">
+      <genFeatures children="true" createChild="false" propertySortChoices="true"
+          ecoreFeature="ecore:EReference security.ecore#//ReferenceFilter/reference"/>
+    </genClasses>
+    <genClasses ecoreClass="security.ecore#//PackageFilter">
+      <genFeatures notify="false" createChild="false" propertySortChoices="true" ecoreFeature="ecore:EReference security.ecore#//PackageFilter/applicablePackage"/>
+    </genClasses>
+    <genClasses ecoreClass="security.ecore#//ClassFilter">
+      <genFeatures notify="false" createChild="false" propertySortChoices="true" ecoreFeature="ecore:EReference security.ecore#//ClassFilter/applicableClass"/>
+    </genClasses>
+    <genClasses ecoreClass="security.ecore#//ResourceFilter">
+      <genFeatures createChild="false" ecoreFeature="ecore:EAttribute security.ecore#//ResourceFilter/pattern"/>
+    </genClasses>
+    <genClasses image="false" ecoreClass="security.ecore#//ObjectFilter"/>
+    <genClasses ecoreClass="security.ecore#//ExpressionFilter">
+      <genFeatures property="None" children="true" createChild="true" ecoreFeature="ecore:EReference security.ecore#//ExpressionFilter/expression"/>
+    </genClasses>
+    <genClasses image="false" ecoreClass="security.ecore#//CombinedFilter">
+      <genFeatures property="None" children="true" createChild="true" ecoreFeature="ecore:EReference security.ecore#//CombinedFilter/operands"/>
+    </genClasses>
+    <genClasses ecoreClass="security.ecore#//NotFilter"/>
+    <genClasses ecoreClass="security.ecore#//AndFilter"/>
+    <genClasses ecoreClass="security.ecore#//OrFilter"/>
   </genPackages>
 </genmodel:GenModel>
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/AndFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/AndFilter.java
new file mode 100644
index 0000000000..f77fecdcb0
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/AndFilter.java
@@ -0,0 +1,18 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>And Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getAndFilter()
+ * @model
+ * @generated
+ */
+public interface AndFilter extends CombinedFilter
+{
+} // AndFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassFilter.java
new file mode 100644
index 0000000000..2a72ce4b1f
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassFilter.java
@@ -0,0 +1,80 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Class Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.ClassFilter#getApplicableClass <em>Applicable Class</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.ClassFilter#isSubTypes <em>Sub Types</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getClassFilter()
+ * @model
+ * @generated
+ */
+public interface ClassFilter extends PermissionFilter
+{
+  /**
+   * Returns the value of the '<em><b>Applicable Class</b></em>' reference.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Applicable Class</em>' reference isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Applicable Class</em>' reference.
+   * @see #setApplicableClass(EClass)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getClassFilter_ApplicableClass()
+   * @model required="true"
+   * @generated
+   */
+  EClass getApplicableClass();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.ClassFilter#getApplicableClass <em>Applicable Class</em>}' reference.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Applicable Class</em>' reference.
+   * @see #getApplicableClass()
+   * @generated
+   */
+  void setApplicableClass(EClass value);
+
+  /**
+   * Returns the value of the '<em><b>Sub Types</b></em>' attribute.
+   * The default value is <code>"true"</code>.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Sub Types</em>' attribute isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Sub Types</em>' attribute.
+   * @see #setSubTypes(boolean)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getClassFilter_SubTypes()
+   * @model default="true"
+   * @generated
+   */
+  boolean isSubTypes();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.ClassFilter#isSubTypes <em>Sub Types</em>}' attribute.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Sub Types</em>' attribute.
+   * @see #isSubTypes()
+   * @generated
+   */
+  void setSubTypes(boolean value);
+
+} // ClassFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassPermission.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassPermission.java
index 30d88b196e..14cdb5f78a 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassPermission.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ClassPermission.java
@@ -15,6 +15,7 @@ import org.eclipse.emf.ecore.EClass;
 /**
  * <!-- begin-user-doc -->
  * A representation of the model object '<em><b>Class Permissionermission</b></em>'.
+ * @deprecated As of 4.3 use {@link FilterPermission} and {@link ClassFilter}.
  * <!-- end-user-doc -->
  *
  * <p>
@@ -28,6 +29,7 @@ import org.eclipse.emf.ecore.EClass;
  * @model
  * @generated
  */
+@Deprecated
 public interface ClassPermission extends Permission
 {
   /**
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/CombinedFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/CombinedFilter.java
new file mode 100644
index 0000000000..f781383fb7
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/CombinedFilter.java
@@ -0,0 +1,42 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.common.util.EList;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Combined Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.CombinedFilter#getOperands <em>Operands</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getCombinedFilter()
+ * @model abstract="true"
+ * @generated
+ */
+public interface CombinedFilter extends PermissionFilter
+{
+  /**
+   * Returns the value of the '<em><b>Operands</b></em>' containment reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.PermissionFilter}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Operands</em>' containment reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Operands</em>' containment reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getCombinedFilter_Operands()
+   * @model containment="true" required="true"
+   * @generated
+   */
+  EList<PermissionFilter> getOperands();
+
+} // CombinedFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ExpressionFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ExpressionFilter.java
new file mode 100644
index 0000000000..3805288c03
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ExpressionFilter.java
@@ -0,0 +1,52 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.cdo.expressions.Expression;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Expression Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.ExpressionFilter#getExpression <em>Expression</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getExpressionFilter()
+ * @model
+ * @generated
+ */
+public interface ExpressionFilter extends ObjectFilter
+{
+  /**
+   * Returns the value of the '<em><b>Expression</b></em>' containment reference.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Expression</em>' containment reference isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Expression</em>' containment reference.
+   * @see #setExpression(Expression)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getExpressionFilter_Expression()
+   * @model containment="true" required="true"
+   * @generated
+   */
+  Expression getExpression();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.ExpressionFilter#getExpression <em>Expression</em>}' containment reference.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Expression</em>' containment reference.
+   * @see #getExpression()
+   * @generated
+   */
+  void setExpression(Expression value);
+
+} // ExpressionFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/FilterPermission.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/FilterPermission.java
new file mode 100644
index 0000000000..d38349f100
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/FilterPermission.java
@@ -0,0 +1,42 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.common.util.EList;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Filter Permission</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.FilterPermission#getFilters <em>Filters</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getFilterPermission()
+ * @model
+ * @generated
+ */
+public interface FilterPermission extends Permission
+{
+  /**
+   * Returns the value of the '<em><b>Filters</b></em>' containment reference list.
+   * The list contents are of type {@link org.eclipse.emf.cdo.security.PermissionFilter}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Filters</em>' containment reference list isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Filters</em>' containment reference list.
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getFilterPermission_Filters()
+   * @model containment="true" required="true"
+   * @generated
+   */
+  EList<PermissionFilter> getFilters();
+
+} // FilterPermission
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Inclusion.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Inclusion.java
new file mode 100644
index 0000000000..e59354e76e
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/Inclusion.java
@@ -0,0 +1,269 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.common.util.Enumerator;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the literals of the enumeration '<em><b>Inclusion</b></em>',
+ * and utility methods for working with them.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getInclusion()
+ * @model
+ * @generated
+ */
+public enum Inclusion implements Enumerator
+{
+  /**
+   * The '<em><b>Exact</b></em>' literal object.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @see #EXACT_VALUE
+   * @generated
+   * @ordered
+   */
+  EXACT(0, "Exact", "Exact"), /**
+                              * The '<em><b>Exact And Up</b></em>' literal object.
+                              * <!-- begin-user-doc -->
+                              * <!-- end-user-doc -->
+                              * @see #EXACT_AND_UP_VALUE
+                              * @generated
+                              * @ordered
+                              */
+  EXACT_AND_UP(1, "ExactAndUp", "ExactAndUp"), /**
+                                               * The '<em><b>Exact And Down</b></em>' literal object.
+                                               * <!-- begin-user-doc -->
+                                               * <!-- end-user-doc -->
+                                               * @see #EXACT_AND_DOWN_VALUE
+                                               * @generated
+                                               * @ordered
+                                               */
+  EXACT_AND_DOWN(2, "ExactAndDown", "ExactAndDown"), /**
+                                                     * The '<em><b>Regex</b></em>' literal object.
+                                                     * <!-- begin-user-doc -->
+                                                     * <!-- end-user-doc -->
+                                                     * @see #REGEX_VALUE
+                                                     * @generated
+                                                     * @ordered
+                                                     */
+  REGEX(3, "Regex", "Regex"); //$NON-NLS-1$ //$NON-NLS-2$
+
+  /**
+   * The '<em><b>Exact</b></em>' literal value.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of '<em><b>Exact</b></em>' literal object isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @see #EXACT
+   * @model name="Exact"
+   * @generated
+   * @ordered
+   */
+  public static final int EXACT_VALUE = 0;
+
+  /**
+   * The '<em><b>Exact And Up</b></em>' literal value.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of '<em><b>Exact And Up</b></em>' literal object isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @see #EXACT_AND_UP
+   * @model name="ExactAndUp"
+   * @generated
+   * @ordered
+   */
+  public static final int EXACT_AND_UP_VALUE = 1;
+
+  /**
+   * The '<em><b>Exact And Down</b></em>' literal value.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of '<em><b>Exact And Down</b></em>' literal object isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @see #EXACT_AND_DOWN
+   * @model name="ExactAndDown"
+   * @generated
+   * @ordered
+   */
+  public static final int EXACT_AND_DOWN_VALUE = 2;
+
+  /**
+   * The '<em><b>Regex</b></em>' literal value.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of '<em><b>Regex</b></em>' literal object isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @see #REGEX
+   * @model name="Regex"
+   * @generated
+   * @ordered
+   */
+  public static final int REGEX_VALUE = 3;
+
+  /**
+   * An array of all the '<em><b>Inclusion</b></em>' enumerators.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private static final Inclusion[] VALUES_ARRAY = new Inclusion[] { EXACT, EXACT_AND_UP, EXACT_AND_DOWN, REGEX, };
+
+  /**
+   * A public read-only list of all the '<em><b>Inclusion</b></em>' enumerators.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public static final List<Inclusion> VALUES = Collections.unmodifiableList(Arrays.asList(VALUES_ARRAY));
+
+  /**
+   * Returns the '<em><b>Inclusion</b></em>' literal with the specified literal value.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public static Inclusion get(String literal)
+  {
+    for (int i = 0; i < VALUES_ARRAY.length; ++i)
+    {
+      Inclusion result = VALUES_ARRAY[i];
+      if (result.toString().equals(literal))
+      {
+        return result;
+      }
+    }
+    return null;
+  }
+
+  /**
+   * Returns the '<em><b>Inclusion</b></em>' literal with the specified name.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public static Inclusion getByName(String name)
+  {
+    for (int i = 0; i < VALUES_ARRAY.length; ++i)
+    {
+      Inclusion result = VALUES_ARRAY[i];
+      if (result.getName().equals(name))
+      {
+        return result;
+      }
+    }
+    return null;
+  }
+
+  /**
+   * Returns the '<em><b>Inclusion</b></em>' literal with the specified integer value.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public static Inclusion get(int value)
+  {
+    switch (value)
+    {
+    case EXACT_VALUE:
+      return EXACT;
+    case EXACT_AND_UP_VALUE:
+      return EXACT_AND_UP;
+    case EXACT_AND_DOWN_VALUE:
+      return EXACT_AND_DOWN;
+    case REGEX_VALUE:
+      return REGEX;
+    }
+    return null;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private final int value;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private final String name;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private final String literal;
+
+  /**
+   * Only this class can construct instances.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private Inclusion(int value, String name, String literal)
+  {
+    this.value = value;
+    this.name = name;
+    this.literal = literal;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public int getValue()
+  {
+    return value;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public String getName()
+  {
+    return name;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public String getLiteral()
+  {
+    return literal;
+  }
+
+  /**
+   * Returns the literal value of the enumerator, which is its string representation.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  public String toString()
+  {
+    return literal;
+  }
+
+} // Inclusion
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/LinkedFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/LinkedFilter.java
new file mode 100644
index 0000000000..81136ada25
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/LinkedFilter.java
@@ -0,0 +1,50 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Reference Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.LinkedFilter#getFilter <em>Filter</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getLinkedFilter()
+ * @model
+ * @generated
+ */
+public interface LinkedFilter extends PermissionFilter
+{
+  /**
+   * Returns the value of the '<em><b>Filter</b></em>' reference.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Filter</em>' reference isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Filter</em>' reference.
+   * @see #setFilter(PermissionFilter)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getLinkedFilter_Filter()
+   * @model required="true"
+   * @generated
+   */
+  PermissionFilter getFilter();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.LinkedFilter#getFilter <em>Filter</em>}' reference.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Filter</em>' reference.
+   * @see #getFilter()
+   * @generated
+   */
+  void setFilter(PermissionFilter value);
+
+} // ReferenceFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/NotFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/NotFilter.java
new file mode 100644
index 0000000000..7385d1c76d
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/NotFilter.java
@@ -0,0 +1,18 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Not Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getNotFilter()
+ * @model
+ * @generated
+ */
+public interface NotFilter extends CombinedFilter
+{
+} // NotFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectFilter.java
new file mode 100644
index 0000000000..ec46f3fe04
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectFilter.java
@@ -0,0 +1,18 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Object Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getObjectFilter()
+ * @model abstract="true"
+ * @generated
+ */
+public interface ObjectFilter extends PermissionFilter
+{
+} // ObjectFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectPermission.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectPermission.java
index f6a28a6a78..46db2f340a 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectPermission.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ObjectPermission.java
@@ -14,6 +14,7 @@ package org.eclipse.emf.cdo.security;
  * <!-- begin-user-doc -->
  * A representation of the model object '<em><b>Object Permission</b></em>'.
  * @since 4.2
+ * @deprecated As of 4.3 use {@link FilterPermission} and {@link ObjectFilter}.
  * <!-- end-user-doc -->
  *
  *
@@ -21,6 +22,7 @@ package org.eclipse.emf.cdo.security;
  * @model abstract="true"
  * @generated
  */
+@Deprecated
 public interface ObjectPermission extends Permission
 {
 } // ObjectPermission
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/OrFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/OrFilter.java
new file mode 100644
index 0000000000..28d6660573
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/OrFilter.java
@@ -0,0 +1,18 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Or Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getOrFilter()
+ * @model
+ * @generated
+ */
+public interface OrFilter extends CombinedFilter
+{
+} // OrFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackageFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackageFilter.java
new file mode 100644
index 0000000000..eac413ee4e
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackageFilter.java
@@ -0,0 +1,52 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.ecore.EPackage;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Package Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.PackageFilter#getApplicablePackage <em>Applicable Package</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getPackageFilter()
+ * @model
+ * @generated
+ */
+public interface PackageFilter extends PermissionFilter
+{
+  /**
+   * Returns the value of the '<em><b>Applicable Package</b></em>' reference.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Applicable Package</em>' reference isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Applicable Package</em>' reference.
+   * @see #setApplicablePackage(EPackage)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getPackageFilter_ApplicablePackage()
+   * @model required="true"
+   * @generated
+   */
+  EPackage getApplicablePackage();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.PackageFilter#getApplicablePackage <em>Applicable Package</em>}' reference.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Applicable Package</em>' reference.
+   * @see #getApplicablePackage()
+   * @generated
+   */
+  void setApplicablePackage(EPackage value);
+
+} // PackageFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackagePermission.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackagePermission.java
index 4cf861efc0..9f833b8e62 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackagePermission.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PackagePermission.java
@@ -15,6 +15,7 @@ import org.eclipse.emf.ecore.EPackage;
 /**
  * <!-- begin-user-doc -->
  * A representation of the model object '<em><b>Package Permission</b></em>'.
+ * @deprecated As of 4.3 use {@link FilterPermission} and {@link PackageFilter}.
  * <!-- end-user-doc -->
  *
  * <p>
@@ -28,6 +29,7 @@ import org.eclipse.emf.ecore.EPackage;
  * @model
  * @generated
  */
+@Deprecated
 public interface PackagePermission extends Permission
 {
   /**
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PermissionFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PermissionFilter.java
new file mode 100644
index 0000000000..deb3b1ef29
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/PermissionFilter.java
@@ -0,0 +1,28 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+import org.eclipse.emf.cdo.CDOObject;
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Permission Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getPermissionFilter()
+ * @model abstract="true"
+ * @extends CDOObject
+ * @generated
+ */
+public interface PermissionFilter extends CDOObject
+{
+  boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext);
+
+  String format();
+
+} // PermissionFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourceFilter.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourceFilter.java
new file mode 100644
index 0000000000..02e0dbcd7c
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourceFilter.java
@@ -0,0 +1,81 @@
+/**
+ */
+package org.eclipse.emf.cdo.security;
+
+/**
+ * <!-- begin-user-doc -->
+ * A representation of the model object '<em><b>Resource Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ *
+ * <p>
+ * The following features are supported:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.ResourceFilter#getPath <em>Path</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.ResourceFilter#getInclusion <em>Inclusion</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @see org.eclipse.emf.cdo.security.SecurityPackage#getResourceFilter()
+ * @model
+ * @generated
+ */
+public interface ResourceFilter extends PermissionFilter
+{
+  /**
+   * Returns the value of the '<em><b>Path</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Path</em>' attribute isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Path</em>' attribute.
+   * @see #setPath(String)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getResourceFilter_Path()
+   * @model
+   * @generated
+   */
+  String getPath();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.ResourceFilter#getPath <em>Path</em>}' attribute.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Path</em>' attribute.
+   * @see #getPath()
+   * @generated
+   */
+  void setPath(String value);
+
+  /**
+   * Returns the value of the '<em><b>Inclusion</b></em>' attribute.
+   * The default value is <code>"Regex"</code>.
+   * The literals are from the enumeration {@link org.eclipse.emf.cdo.security.Inclusion}.
+   * <!-- begin-user-doc -->
+   * <p>
+   * If the meaning of the '<em>Inclusion</em>' attribute isn't clear,
+   * there really should be more of a description here...
+   * </p>
+   * <!-- end-user-doc -->
+   * @return the value of the '<em>Inclusion</em>' attribute.
+   * @see org.eclipse.emf.cdo.security.Inclusion
+   * @see #setInclusion(Inclusion)
+   * @see org.eclipse.emf.cdo.security.SecurityPackage#getResourceFilter_Inclusion()
+   * @model default="Regex"
+   * @generated
+   */
+  Inclusion getInclusion();
+
+  /**
+   * Sets the value of the '{@link org.eclipse.emf.cdo.security.ResourceFilter#getInclusion <em>Inclusion</em>}' attribute.
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @param value the new value of the '<em>Inclusion</em>' attribute.
+   * @see org.eclipse.emf.cdo.security.Inclusion
+   * @see #getInclusion()
+   * @generated
+   */
+  void setInclusion(Inclusion value);
+
+} // ResourceFilter
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourcePermission.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourcePermission.java
index 0475846c98..76cd3405fc 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourcePermission.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/ResourcePermission.java
@@ -13,6 +13,7 @@ package org.eclipse.emf.cdo.security;
 /**
  * <!-- begin-user-doc -->
  * A representation of the model object '<em><b>Resource Permission</b></em>'.
+ * @deprecated As of 4.3 use {@link FilterPermission} and {@link ResourceFilter}.
  * <!-- end-user-doc -->
  *
  * <p>
@@ -26,6 +27,7 @@ package org.eclipse.emf.cdo.security;
  * @model
  * @generated
  */
+@Deprecated
 public interface ResourcePermission extends Permission
 {
   /**
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityFactory.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityFactory.java
index ba0dcd9945..66905a8302 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityFactory.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityFactory.java
@@ -10,6 +10,8 @@
  */
 package org.eclipse.emf.cdo.security;
 
+import org.eclipse.emf.cdo.expressions.Expression;
+
 import org.eclipse.emf.ecore.EClass;
 import org.eclipse.emf.ecore.EFactory;
 import org.eclipse.emf.ecore.EPackage;
@@ -126,46 +128,203 @@ public interface SecurityFactory extends EFactory
   /**
    * Returns a new object of class '<em>Class Permission</em>'.
    * <!-- begin-user-doc -->
+   * @deprecated As of 4.3 use {@link #createFilterPermission()} and {@link #createClassFilter()}.
    * <!-- end-user-doc -->
    * @return a new object of class '<em>Class Permission</em>'.
    * @generated
    */
+  @Deprecated
   ClassPermission createClassPermission();
 
   /**
    * @since 4.2
+   * @deprecated As of 4.3 use {@link #createFilterPermission(Access, PermissionFilter...)} and {@link #createClassFilter(EClass)}.
    */
+  @Deprecated
   ClassPermission createClassPermission(EClass eClass, Access access);
 
   /**
    * Returns a new object of class '<em>Package Permission</em>'.
    * <!-- begin-user-doc -->
+   * @deprecated As of 4.3 use {@link #createFilterPermission()} and {@link #createPackageFilter()}.
    * <!-- end-user-doc -->
    * @return a new object of class '<em>Package Permission</em>'.
    * @generated
    */
+  @Deprecated
   PackagePermission createPackagePermission();
 
   /**
    * @since 4.2
+   * @deprecated As of 4.3 use {@link #createFilterPermission(Access, PermissionFilter...)} and {@link #createPackageFilter(EPackage)}.
    */
+  @Deprecated
   PackagePermission createPackagePermission(EPackage ePackage, Access access);
 
   /**
    * Returns a new object of class '<em>Resource Permission</em>'.
    * <!-- begin-user-doc -->
+   * @deprecated As of 4.3 use {@link #createFilterPermission()} and {@link #createResourceFilter()}.
    * <!-- end-user-doc -->
    * @return a new object of class '<em>Resource Permission</em>'.
    * @generated
    */
+  @Deprecated
   ResourcePermission createResourcePermission();
 
   /**
    * @since 4.2
+   * @deprecated As of 4.3 use {@link #createFilterPermission()} and {@link #createResourceFilter(String)}.
    */
+  @Deprecated
   ResourcePermission createResourcePermission(String pattern, Access access);
 
   /**
+   * Returns a new object of class '<em>Filter Permission</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Filter Permission</em>'.
+   * @generated
+   */
+  FilterPermission createFilterPermission();
+
+  /**
+   * Returns a new object of class '<em>Linked Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Linked Filter</em>'.
+   * @generated
+   */
+  LinkedFilter createLinkedFilter();
+
+  /**
+   * @since 4.3
+   */
+  FilterPermission createFilterPermission(Access access, PermissionFilter... filters);
+
+  /**
+   * Returns a new object of class '<em>Package Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Package Filter</em>'.
+   * @generated
+   */
+  PackageFilter createPackageFilter();
+
+  /**
+   * @since 4.3
+   */
+  PackageFilter createPackageFilter(EPackage ePackage);
+
+  /**
+   * Returns a new object of class '<em>Class Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Class Filter</em>'.
+   * @generated
+   */
+  ClassFilter createClassFilter();
+
+  /**
+   * @since 4.3
+   */
+  ClassFilter createClassFilter(EClass eClass);
+
+  /**
+   * Returns a new object of class '<em>Resource Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Resource Filter</em>'.
+   * @generated
+   */
+  ResourceFilter createResourceFilter();
+
+  /**
+   * @since 4.3
+   */
+  ResourceFilter createResourceFilter(String path);
+
+  /**
+   * @since 4.3
+   */
+  ResourceFilter createResourceFilter(String path, Inclusion inclusion);
+
+  /**
+   * Returns a new object of class '<em>Expression Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Expression Filter</em>'.
+   * @generated
+   */
+  ExpressionFilter createExpressionFilter();
+
+  /**
+   * @since 4.3
+   */
+  ExpressionFilter createExpressionFilter(Expression expression);
+
+  /**
+   * Returns a new object of class '<em>Not Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Not Filter</em>'.
+   * @generated
+   */
+  NotFilter createNotFilter();
+
+  /**
+   * Returns a new object of class '<em>And Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>And Filter</em>'.
+   * @generated
+   */
+  AndFilter createAndFilter();
+
+  /**
+   * Returns a new object of class '<em>Or Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Or Filter</em>'.
+   * @generated
+   */
+  OrFilter createOrFilter();
+
+  /**
+   * @since 4.3
+   */
+  NotFilter createNotFilter(PermissionFilter operand);
+
+  /**
+   * Returns a new object of class '<em>And Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>And Filter</em>'.
+   * @generated NOT
+   */
+  AndFilter createAndFilter(PermissionFilter... operands);
+
+  /**
+   * Returns a new object of class '<em>Or Filter</em>'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return a new object of class '<em>Or Filter</em>'.
+   * @generated NOT
+   */
+  OrFilter createOrFilter(PermissionFilter... operands);
+
+  /**
    * Returns the package supported by this factory.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityItemContainer.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityItemContainer.java
index 51c8bdd300..b184f24098 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityItemContainer.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityItemContainer.java
@@ -11,7 +11,11 @@
 package org.eclipse.emf.cdo.security;
 
 /**
- * A {@link SecurityItemProvider security item provider} that {@link SecurityItem items} such as {@link User users} or {@link Role roles} can be added to or removed from.
+ * A {@link SecurityItemProvider security item provider} that {@link SecurityItem items} 
+ * such as {@link User users} or {@link Role roles} can be added to or removed from.
+ * 
+ * @noextend This interface is not intended to be extended by clients.
+ * @noimplement This interface is not intended to be implemented by clients.
  * @author Eike Stepper
  * @since 4.2
  */
@@ -25,6 +29,11 @@ public interface SecurityItemContainer extends SecurityItemProvider
 
   public User addUser(String id, String password);
 
+  /**
+   * @since 4.3
+   */
+  public User setPassword(String id, String password);
+
   public Role removeRole(String id);
 
   public Group removeGroup(String id);
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java
index 5496f6269d..26a492923d 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/SecurityPackage.java
@@ -903,6 +903,409 @@ public interface SecurityPackage extends EPackage
   int OBJECT_PERMISSION_FEATURE_COUNT = PERMISSION_FEATURE_COUNT + 0;
 
   /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.FilterPermissionImpl <em>Filter Permission</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.FilterPermissionImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getFilterPermission()
+   * @generated
+   */
+  int FILTER_PERMISSION = 14;
+
+  /**
+   * The feature id for the '<em><b>Role</b></em>' container reference.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int FILTER_PERMISSION__ROLE = PERMISSION__ROLE;
+
+  /**
+   * The feature id for the '<em><b>Access</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int FILTER_PERMISSION__ACCESS = PERMISSION__ACCESS;
+
+  /**
+   * The feature id for the '<em><b>Filters</b></em>' containment reference list.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int FILTER_PERMISSION__FILTERS = PERMISSION_FEATURE_COUNT + 0;
+
+  /**
+   * The number of structural features of the '<em>Filter Permission</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int FILTER_PERMISSION_FEATURE_COUNT = PERMISSION_FEATURE_COUNT + 1;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.PermissionFilterImpl <em>Permission Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.PermissionFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getPermissionFilter()
+   * @generated
+   */
+  int PERMISSION_FILTER = 15;
+
+  /**
+   * The number of structural features of the '<em>Permission Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int PERMISSION_FILTER_FEATURE_COUNT = 0;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.LinkedFilterImpl <em>Linked Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.LinkedFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getLinkedFilter()
+   * @generated
+   */
+  int LINKED_FILTER = 16;
+
+  /**
+   * The feature id for the '<em><b>Filter</b></em>' reference.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int LINKED_FILTER__FILTER = PERMISSION_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The number of structural features of the '<em>Linked Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int LINKED_FILTER_FEATURE_COUNT = PERMISSION_FILTER_FEATURE_COUNT + 1;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.PackageFilterImpl <em>Package Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.PackageFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getPackageFilter()
+   * @generated
+   */
+  int PACKAGE_FILTER = 17;
+
+  /**
+   * The feature id for the '<em><b>Applicable Package</b></em>' reference.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int PACKAGE_FILTER__APPLICABLE_PACKAGE = PERMISSION_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The number of structural features of the '<em>Package Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int PACKAGE_FILTER_FEATURE_COUNT = PERMISSION_FILTER_FEATURE_COUNT + 1;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.ClassFilterImpl <em>Class Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.ClassFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getClassFilter()
+   * @generated
+   */
+  int CLASS_FILTER = 18;
+
+  /**
+   * The feature id for the '<em><b>Applicable Class</b></em>' reference.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int CLASS_FILTER__APPLICABLE_CLASS = PERMISSION_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The feature id for the '<em><b>Sub Types</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int CLASS_FILTER__SUB_TYPES = PERMISSION_FILTER_FEATURE_COUNT + 1;
+
+  /**
+   * The number of structural features of the '<em>Class Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int CLASS_FILTER_FEATURE_COUNT = PERMISSION_FILTER_FEATURE_COUNT + 2;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.ResourceFilterImpl <em>Resource Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.ResourceFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getResourceFilter()
+   * @generated
+   */
+  int RESOURCE_FILTER = 19;
+
+  /**
+   * The feature id for the '<em><b>Path</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int RESOURCE_FILTER__PATH = PERMISSION_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The feature id for the '<em><b>Inclusion</b></em>' attribute.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int RESOURCE_FILTER__INCLUSION = PERMISSION_FILTER_FEATURE_COUNT + 1;
+
+  /**
+   * The number of structural features of the '<em>Resource Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int RESOURCE_FILTER_FEATURE_COUNT = PERMISSION_FILTER_FEATURE_COUNT + 2;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.ObjectFilterImpl <em>Object Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.ObjectFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getObjectFilter()
+   * @generated
+   */
+  int OBJECT_FILTER = 20;
+
+  /**
+   * The number of structural features of the '<em>Object Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int OBJECT_FILTER_FEATURE_COUNT = PERMISSION_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.ExpressionFilterImpl <em>Expression Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.ExpressionFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getExpressionFilter()
+   * @generated
+   */
+  int EXPRESSION_FILTER = 21;
+
+  /**
+   * The feature id for the '<em><b>Expression</b></em>' containment reference.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int EXPRESSION_FILTER__EXPRESSION = OBJECT_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The number of structural features of the '<em>Expression Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int EXPRESSION_FILTER_FEATURE_COUNT = OBJECT_FILTER_FEATURE_COUNT + 1;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.CombinedFilterImpl <em>Combined Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.CombinedFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getCombinedFilter()
+   * @generated
+   */
+  int COMBINED_FILTER = 22;
+
+  /**
+   * The feature id for the '<em><b>Operands</b></em>' containment reference list.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int COMBINED_FILTER__OPERANDS = PERMISSION_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The number of structural features of the '<em>Combined Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int COMBINED_FILTER_FEATURE_COUNT = PERMISSION_FILTER_FEATURE_COUNT + 1;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.NotFilterImpl <em>Not Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.NotFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getNotFilter()
+   * @generated
+   */
+  int NOT_FILTER = 23;
+
+  /**
+   * The feature id for the '<em><b>Operands</b></em>' containment reference list.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int NOT_FILTER__OPERANDS = COMBINED_FILTER__OPERANDS;
+
+  /**
+   * The number of structural features of the '<em>Not Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int NOT_FILTER_FEATURE_COUNT = COMBINED_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.AndFilterImpl <em>And Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.AndFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getAndFilter()
+   * @generated
+   */
+  int AND_FILTER = 24;
+
+  /**
+   * The feature id for the '<em><b>Operands</b></em>' containment reference list.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int AND_FILTER__OPERANDS = COMBINED_FILTER__OPERANDS;
+
+  /**
+   * The number of structural features of the '<em>And Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int AND_FILTER_FEATURE_COUNT = COMBINED_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.impl.OrFilterImpl <em>Or Filter</em>}' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.impl.OrFilterImpl
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getOrFilter()
+   * @generated
+   */
+  int OR_FILTER = 25;
+
+  /**
+   * The feature id for the '<em><b>Operands</b></em>' containment reference list.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int OR_FILTER__OPERANDS = COMBINED_FILTER__OPERANDS;
+
+  /**
+   * The number of structural features of the '<em>Or Filter</em>' class.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   * @ordered
+   */
+  int OR_FILTER_FEATURE_COUNT = COMBINED_FILTER_FEATURE_COUNT + 0;
+
+  /**
+   * The meta object id for the '{@link org.eclipse.emf.cdo.security.Inclusion <em>Inclusion</em>}' enum.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @see org.eclipse.emf.cdo.security.Inclusion
+   * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getInclusion()
+   * @generated
+   */
+  int INCLUSION = 26;
+
+  /**
    * The meta object id for the '{@link org.eclipse.emf.cdo.security.Access <em>Access</em>}' enum.
    * <!-- begin-user-doc -->
    * @noreference This field is not intended to be referenced by clients.
@@ -911,7 +1314,7 @@ public interface SecurityPackage extends EPackage
    * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getAccess()
    * @generated
    */
-  int ACCESS = 14;
+  int ACCESS = 27;
 
   /**
    * The meta object id for the '<em>Access Object</em>' data type.
@@ -922,7 +1325,7 @@ public interface SecurityPackage extends EPackage
    * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getAccessObject()
    * @generated
    */
-  int ACCESS_OBJECT = 15;
+  int ACCESS_OBJECT = 28;
 
   /**
    * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.SecurityElement <em>Element</em>}'.
@@ -1531,6 +1934,257 @@ public interface SecurityPackage extends EPackage
   EClass getObjectPermission();
 
   /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.FilterPermission <em>Filter Permission</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Filter Permission</em>'.
+   * @see org.eclipse.emf.cdo.security.FilterPermission
+   * @generated
+   */
+  EClass getFilterPermission();
+
+  /**
+   * Returns the meta object for the containment reference list '{@link org.eclipse.emf.cdo.security.FilterPermission#getFilters <em>Filters</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the containment reference list '<em>Filters</em>'.
+   * @see org.eclipse.emf.cdo.security.FilterPermission#getFilters()
+   * @see #getFilterPermission()
+   * @generated
+   */
+  EReference getFilterPermission_Filters();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.PermissionFilter <em>Permission Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Permission Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.PermissionFilter
+   * @generated
+   */
+  EClass getPermissionFilter();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.LinkedFilter <em>Linked Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Linked Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.LinkedFilter
+   * @generated
+   */
+  EClass getLinkedFilter();
+
+  /**
+   * Returns the meta object for the reference '{@link org.eclipse.emf.cdo.security.LinkedFilter#getFilter <em>Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference '<em>Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.LinkedFilter#getFilter()
+   * @see #getLinkedFilter()
+   * @generated
+   */
+  EReference getLinkedFilter_Filter();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.PackageFilter <em>Package Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Package Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.PackageFilter
+   * @generated
+   */
+  EClass getPackageFilter();
+
+  /**
+   * Returns the meta object for the reference '{@link org.eclipse.emf.cdo.security.PackageFilter#getApplicablePackage <em>Applicable Package</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference '<em>Applicable Package</em>'.
+   * @see org.eclipse.emf.cdo.security.PackageFilter#getApplicablePackage()
+   * @see #getPackageFilter()
+   * @generated
+   */
+  EReference getPackageFilter_ApplicablePackage();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.ClassFilter <em>Class Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Class Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.ClassFilter
+   * @generated
+   */
+  EClass getClassFilter();
+
+  /**
+   * Returns the meta object for the reference '{@link org.eclipse.emf.cdo.security.ClassFilter#getApplicableClass <em>Applicable Class</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the reference '<em>Applicable Class</em>'.
+   * @see org.eclipse.emf.cdo.security.ClassFilter#getApplicableClass()
+   * @see #getClassFilter()
+   * @generated
+   */
+  EReference getClassFilter_ApplicableClass();
+
+  /**
+   * Returns the meta object for the attribute '{@link org.eclipse.emf.cdo.security.ClassFilter#isSubTypes <em>Sub Types</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the attribute '<em>Sub Types</em>'.
+   * @see org.eclipse.emf.cdo.security.ClassFilter#isSubTypes()
+   * @see #getClassFilter()
+   * @generated
+   */
+  EAttribute getClassFilter_SubTypes();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.ResourceFilter <em>Resource Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Resource Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.ResourceFilter
+   * @generated
+   */
+  EClass getResourceFilter();
+
+  /**
+   * Returns the meta object for the attribute '{@link org.eclipse.emf.cdo.security.ResourceFilter#getPath <em>Path</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the attribute '<em>Path</em>'.
+   * @see org.eclipse.emf.cdo.security.ResourceFilter#getPath()
+   * @see #getResourceFilter()
+   * @generated
+   */
+  EAttribute getResourceFilter_Path();
+
+  /**
+   * Returns the meta object for the attribute '{@link org.eclipse.emf.cdo.security.ResourceFilter#getInclusion <em>Inclusion</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the attribute '<em>Inclusion</em>'.
+   * @see org.eclipse.emf.cdo.security.ResourceFilter#getInclusion()
+   * @see #getResourceFilter()
+   * @generated
+   */
+  EAttribute getResourceFilter_Inclusion();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.ObjectFilter <em>Object Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Object Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.ObjectFilter
+   * @generated
+   */
+  EClass getObjectFilter();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.ExpressionFilter <em>Expression Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Expression Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.ExpressionFilter
+   * @generated
+   */
+  EClass getExpressionFilter();
+
+  /**
+   * Returns the meta object for the containment reference '{@link org.eclipse.emf.cdo.security.ExpressionFilter#getExpression <em>Expression</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the containment reference '<em>Expression</em>'.
+   * @see org.eclipse.emf.cdo.security.ExpressionFilter#getExpression()
+   * @see #getExpressionFilter()
+   * @generated
+   */
+  EReference getExpressionFilter_Expression();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.CombinedFilter <em>Combined Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Combined Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.CombinedFilter
+   * @generated
+   */
+  EClass getCombinedFilter();
+
+  /**
+   * Returns the meta object for the containment reference list '{@link org.eclipse.emf.cdo.security.CombinedFilter#getOperands <em>Operands</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for the containment reference list '<em>Operands</em>'.
+   * @see org.eclipse.emf.cdo.security.CombinedFilter#getOperands()
+   * @see #getCombinedFilter()
+   * @generated
+   */
+  EReference getCombinedFilter_Operands();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.NotFilter <em>Not Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Not Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.NotFilter
+   * @generated
+   */
+  EClass getNotFilter();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.AndFilter <em>And Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>And Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.AndFilter
+   * @generated
+   */
+  EClass getAndFilter();
+
+  /**
+   * Returns the meta object for class '{@link org.eclipse.emf.cdo.security.OrFilter <em>Or Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for class '<em>Or Filter</em>'.
+   * @see org.eclipse.emf.cdo.security.OrFilter
+   * @generated
+   */
+  EClass getOrFilter();
+
+  /**
+   * Returns the meta object for enum '{@link org.eclipse.emf.cdo.security.Inclusion <em>Inclusion</em>}'.
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the meta object for enum '<em>Inclusion</em>'.
+   * @see org.eclipse.emf.cdo.security.Inclusion
+   * @generated
+   */
+  EEnum getInclusion();
+
+  /**
    * Returns the meta object for enum '{@link org.eclipse.emf.cdo.security.Access <em>Access</em>}'.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -2058,6 +2712,230 @@ public interface SecurityPackage extends EPackage
     EClass OBJECT_PERMISSION = eINSTANCE.getObjectPermission();
 
     /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.FilterPermissionImpl <em>Filter Permission</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.FilterPermissionImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getFilterPermission()
+     * @generated
+     */
+    EClass FILTER_PERMISSION = eINSTANCE.getFilterPermission();
+
+    /**
+     * The meta object literal for the '<em><b>Filters</b></em>' containment reference list feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference FILTER_PERMISSION__FILTERS = eINSTANCE.getFilterPermission_Filters();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.PermissionFilterImpl <em>Permission Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.PermissionFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getPermissionFilter()
+     * @generated
+     */
+    EClass PERMISSION_FILTER = eINSTANCE.getPermissionFilter();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.LinkedFilterImpl <em>Linked Filter</em>}' class.
+     * <!-- begin-user-doc -->
+    * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.LinkedFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getLinkedFilter()
+     * @generated
+     */
+    EClass LINKED_FILTER = eINSTANCE.getLinkedFilter();
+
+    /**
+     * The meta object literal for the '<em><b>Filter</b></em>' reference feature.
+     * <!-- begin-user-doc -->
+    * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference LINKED_FILTER__FILTER = eINSTANCE.getLinkedFilter_Filter();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.PackageFilterImpl <em>Package Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.PackageFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getPackageFilter()
+     * @generated
+     */
+    EClass PACKAGE_FILTER = eINSTANCE.getPackageFilter();
+
+    /**
+     * The meta object literal for the '<em><b>Applicable Package</b></em>' reference feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference PACKAGE_FILTER__APPLICABLE_PACKAGE = eINSTANCE.getPackageFilter_ApplicablePackage();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.ClassFilterImpl <em>Class Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.ClassFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getClassFilter()
+     * @generated
+     */
+    EClass CLASS_FILTER = eINSTANCE.getClassFilter();
+
+    /**
+     * The meta object literal for the '<em><b>Applicable Class</b></em>' reference feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference CLASS_FILTER__APPLICABLE_CLASS = eINSTANCE.getClassFilter_ApplicableClass();
+
+    /**
+     * The meta object literal for the '<em><b>Sub Types</b></em>' attribute feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EAttribute CLASS_FILTER__SUB_TYPES = eINSTANCE.getClassFilter_SubTypes();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.ResourceFilterImpl <em>Resource Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.ResourceFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getResourceFilter()
+     * @generated
+     */
+    EClass RESOURCE_FILTER = eINSTANCE.getResourceFilter();
+
+    /**
+     * The meta object literal for the '<em><b>Path</b></em>' attribute feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EAttribute RESOURCE_FILTER__PATH = eINSTANCE.getResourceFilter_Path();
+
+    /**
+     * The meta object literal for the '<em><b>Inclusion</b></em>' attribute feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EAttribute RESOURCE_FILTER__INCLUSION = eINSTANCE.getResourceFilter_Inclusion();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.ObjectFilterImpl <em>Object Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.ObjectFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getObjectFilter()
+     * @generated
+     */
+    EClass OBJECT_FILTER = eINSTANCE.getObjectFilter();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.ExpressionFilterImpl <em>Expression Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.ExpressionFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getExpressionFilter()
+     * @generated
+     */
+    EClass EXPRESSION_FILTER = eINSTANCE.getExpressionFilter();
+
+    /**
+     * The meta object literal for the '<em><b>Expression</b></em>' containment reference feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference EXPRESSION_FILTER__EXPRESSION = eINSTANCE.getExpressionFilter_Expression();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.CombinedFilterImpl <em>Combined Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.CombinedFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getCombinedFilter()
+     * @generated
+     */
+    EClass COMBINED_FILTER = eINSTANCE.getCombinedFilter();
+
+    /**
+     * The meta object literal for the '<em><b>Operands</b></em>' containment reference list feature.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @generated
+     */
+    EReference COMBINED_FILTER__OPERANDS = eINSTANCE.getCombinedFilter_Operands();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.NotFilterImpl <em>Not Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.NotFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getNotFilter()
+     * @generated
+     */
+    EClass NOT_FILTER = eINSTANCE.getNotFilter();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.AndFilterImpl <em>And Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.AndFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getAndFilter()
+     * @generated
+     */
+    EClass AND_FILTER = eINSTANCE.getAndFilter();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.impl.OrFilterImpl <em>Or Filter</em>}' class.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.impl.OrFilterImpl
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getOrFilter()
+     * @generated
+     */
+    EClass OR_FILTER = eINSTANCE.getOrFilter();
+
+    /**
+     * The meta object literal for the '{@link org.eclipse.emf.cdo.security.Inclusion <em>Inclusion</em>}' enum.
+     * <!-- begin-user-doc -->
+     * @since 4.3
+     * <!-- end-user-doc -->
+     * @see org.eclipse.emf.cdo.security.Inclusion
+     * @see org.eclipse.emf.cdo.security.impl.SecurityPackageImpl#getInclusion()
+     * @generated
+     */
+    EEnum INCLUSION = eINSTANCE.getInclusion();
+
+    /**
      * The meta object literal for the '{@link org.eclipse.emf.cdo.security.Access <em>Access</em>}' enum.
      * <!-- begin-user-doc -->
      * <!-- end-user-doc -->
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/AndFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/AndFilterImpl.java
new file mode 100644
index 0000000000..8501f3cafd
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/AndFilterImpl.java
@@ -0,0 +1,66 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.AndFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>And Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * </p>
+ *
+ * @generated
+ */
+public class AndFilterImpl extends CombinedFilterImpl implements AndFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected AndFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.AND_FILTER;
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    for (PermissionFilter operand : getOperands())
+    {
+      if (!operand.isApplicable(revision, revisionProvider, securityContext))
+      {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  @Override
+  protected String formatOperator()
+  {
+    return "And";
+  }
+
+} // AndFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassFilterImpl.java
new file mode 100644
index 0000000000..1eda26d57c
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassFilterImpl.java
@@ -0,0 +1,123 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.ClassFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Class Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.ClassFilterImpl#getApplicableClass <em>Applicable Class</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.ClassFilterImpl#isSubTypes <em>Sub Types</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public class ClassFilterImpl extends PermissionFilterImpl implements ClassFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ClassFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.CLASS_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getApplicableClass()
+  {
+    return (EClass)eGet(SecurityPackage.Literals.CLASS_FILTER__APPLICABLE_CLASS, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setApplicableClass(EClass newApplicableClass)
+  {
+    eSet(SecurityPackage.Literals.CLASS_FILTER__APPLICABLE_CLASS, newApplicableClass);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public boolean isSubTypes()
+  {
+    return (Boolean)eGet(SecurityPackage.Literals.CLASS_FILTER__SUB_TYPES, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setSubTypes(boolean newSubTypes)
+  {
+    eSet(SecurityPackage.Literals.CLASS_FILTER__SUB_TYPES, newSubTypes);
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    EClass actualClass = revision.getEClass();
+    EClass applicableClass = getApplicableClass();
+
+    if (isSubTypes())
+    {
+      return applicableClass.isSuperTypeOf(actualClass);
+    }
+
+    return applicableClass == actualClass;
+  }
+
+  public String format()
+  {
+    String label = "?";
+
+    EClass applicableClass = getApplicableClass();
+    if (applicableClass != null)
+    {
+      label = applicableClass.getEPackage().getName() + "." + applicableClass.getName();
+    }
+
+    String operator = formatOperator();
+    return "class" + operator + label;
+  }
+
+  private String formatOperator()
+  {
+    return isSubTypes() ? ">=" : "==";
+  }
+
+} // ClassFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassPermissionImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassPermissionImpl.java
index 0e0336d05d..d115cb6d8a 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassPermissionImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ClassPermissionImpl.java
@@ -31,6 +31,7 @@ import org.eclipse.emf.ecore.EClass;
  *
  * @generated
  */
+@Deprecated
 public class ClassPermissionImpl extends PermissionImpl implements ClassPermission
 {
   /**
@@ -74,9 +75,6 @@ public class ClassPermissionImpl extends PermissionImpl implements ClassPermissi
     eSet(SecurityPackage.Literals.CLASS_PERMISSION__APPLICABLE_CLASS, newApplicableClass);
   }
 
-  /**
-   * @ADDED
-   */
   public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
   {
     EClass actualClass = revision.getEClass();
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/CombinedFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/CombinedFilterImpl.java
new file mode 100644
index 0000000000..d853bcbe08
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/CombinedFilterImpl.java
@@ -0,0 +1,88 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.security.CombinedFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.util.EList;
+import org.eclipse.emf.ecore.EClass;
+
+import java.util.Iterator;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Combined Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.CombinedFilterImpl#getOperands <em>Operands</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public abstract class CombinedFilterImpl extends PermissionFilterImpl implements CombinedFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected CombinedFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.COMBINED_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @SuppressWarnings("unchecked")
+  public EList<PermissionFilter> getOperands()
+  {
+    return (EList<PermissionFilter>)eGet(SecurityPackage.Literals.COMBINED_FILTER__OPERANDS, true);
+  }
+
+  public String format()
+  {
+    StringBuilder builder = new StringBuilder();
+    builder.append(formatOperator());
+
+    EList<PermissionFilter> operands = getOperands();
+    if (!operands.isEmpty())
+    {
+      builder.append("(");
+      Iterator<PermissionFilter> iterator = operands.iterator();
+      builder.append(iterator.next().format());
+
+      while (iterator.hasNext())
+      {
+        builder.append(", ");
+        builder.append(iterator.next().format());
+      }
+
+      builder.append(")");
+    }
+
+    return builder.toString();
+  }
+
+  protected abstract String formatOperator();
+
+} // CombinedFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/DirectoryImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/DirectoryImpl.java
index 791f2d9730..3d703805c2 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/DirectoryImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/DirectoryImpl.java
@@ -155,6 +155,14 @@ public class DirectoryImpl extends SecurityItemImpl implements Directory
   }
 
   /**
+   * @since 4.3
+   */
+  public User setPassword(String id, String password)
+  {
+    return getRealm().setPassword(id, password);
+  }
+
+  /**
    * @since 4.2
    */
   public Role removeRole(String id)
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ExpressionFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ExpressionFilterImpl.java
new file mode 100644
index 0000000000..5acaddf595
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ExpressionFilterImpl.java
@@ -0,0 +1,92 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.CDOObject;
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.expressions.EvaluationContext;
+import org.eclipse.emf.cdo.expressions.Expression;
+import org.eclipse.emf.cdo.expressions.impl.EvaluationContextImpl;
+import org.eclipse.emf.cdo.security.ExpressionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Expression Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.ExpressionFilterImpl#getExpression <em>Expression</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public class ExpressionFilterImpl extends ObjectFilterImpl implements ExpressionFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ExpressionFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.EXPRESSION_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public Expression getExpression()
+  {
+    return (Expression)eGet(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setExpression(Expression newExpression)
+  {
+    eSet(SecurityPackage.Literals.EXPRESSION_FILTER__EXPRESSION, newExpression);
+  }
+
+  @Override
+  protected boolean isApplicable(CDOObject object, CDOBranchPoint securityContext)
+  {
+    EvaluationContext evaluationContext = new EvaluationContextImpl(object);
+
+    Expression expression = getExpression();
+    return (Boolean)expression.evaluate(evaluationContext);
+  }
+
+  public String format()
+  {
+    Expression expression = getExpression();
+    if (expression == null)
+    {
+      return "[?]";
+    }
+
+    return "[" + expression + "]";
+  }
+
+} // ExpressionFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/FilterPermissionImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/FilterPermissionImpl.java
new file mode 100644
index 0000000000..4441cb1011
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/FilterPermissionImpl.java
@@ -0,0 +1,76 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.FilterPermission;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.common.util.EList;
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Filter Permission</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.FilterPermissionImpl#getFilters <em>Filters</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public class FilterPermissionImpl extends PermissionImpl implements FilterPermission
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected FilterPermissionImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.FILTER_PERMISSION;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @SuppressWarnings("unchecked")
+  public EList<PermissionFilter> getFilters()
+  {
+    return (EList<PermissionFilter>)eGet(SecurityPackage.Literals.FILTER_PERMISSION__FILTERS, true);
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    for (PermissionFilter filter : getFilters())
+    {
+      if (!filter.isApplicable(revision, revisionProvider, securityContext))
+      {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+} // FilterPermissionImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/LinkedFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/LinkedFilterImpl.java
new file mode 100644
index 0000000000..86791bcba9
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/LinkedFilterImpl.java
@@ -0,0 +1,86 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.LinkedFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Reference Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.LinkedFilterImpl#getFilter <em>Filter</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public class LinkedFilterImpl extends PermissionFilterImpl implements LinkedFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected LinkedFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.LINKED_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public PermissionFilter getFilter()
+  {
+    return (PermissionFilter)eGet(SecurityPackage.Literals.LINKED_FILTER__FILTER, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setFilter(PermissionFilter newFilter)
+  {
+    eSet(SecurityPackage.Literals.LINKED_FILTER__FILTER, newFilter);
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    return getFilter().isApplicable(revision, revisionProvider, securityContext);
+  }
+
+  public String format()
+  {
+    PermissionFilter filter = getFilter();
+    if (filter == null)
+    {
+      return "?";
+    }
+
+    return filter.format();
+  }
+} // ReferenceFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/NotFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/NotFilterImpl.java
new file mode 100644
index 0000000000..53fb35d64e
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/NotFilterImpl.java
@@ -0,0 +1,59 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.NotFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Not Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * </p>
+ *
+ * @generated
+ */
+public class NotFilterImpl extends CombinedFilterImpl implements NotFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected NotFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.NOT_FILTER;
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    PermissionFilter operand = getOperands().get(0);
+    return !operand.isApplicable(revision, revisionProvider, securityContext);
+  }
+
+  @Override
+  protected String formatOperator()
+  {
+    return "Not";
+  }
+
+} // NotFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectFilterImpl.java
new file mode 100644
index 0000000000..6a0cf6db15
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectFilterImpl.java
@@ -0,0 +1,69 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.CDOObject;
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.id.CDOID;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.internal.security.ViewUtil;
+import org.eclipse.emf.cdo.security.ObjectFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+import org.eclipse.emf.cdo.view.CDOView;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Object Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * </p>
+ *
+ * @generated
+ */
+public abstract class ObjectFilterImpl extends PermissionFilterImpl implements ObjectFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ObjectFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.OBJECT_FILTER;
+  }
+
+  protected CDOView getView(CDORevisionProvider revisionProvider)
+  {
+    return ViewUtil.getView(revisionProvider);
+  }
+
+  /**
+   * @ADDED
+   */
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    CDOView view = getView(revisionProvider);
+    CDOID id = revision.getID();
+
+    CDOObject object = view.getObject(id);
+    return isApplicable(object, securityContext);
+  }
+
+  protected abstract boolean isApplicable(CDOObject object, CDOBranchPoint securityContext);
+
+} // ObjectFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectPermissionImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectPermissionImpl.java
index 7d5efa0d14..277b2325c2 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectPermissionImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ObjectPermissionImpl.java
@@ -32,6 +32,7 @@ import org.eclipse.emf.ecore.EClass;
  *
  * @generated
  */
+@Deprecated
 public abstract class ObjectPermissionImpl extends PermissionImpl implements ObjectPermission
 {
   /**
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/OrFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/OrFilterImpl.java
new file mode 100644
index 0000000000..34aca9e061
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/OrFilterImpl.java
@@ -0,0 +1,66 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.OrFilter;
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Or Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * </p>
+ *
+ * @generated
+ */
+public class OrFilterImpl extends CombinedFilterImpl implements OrFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected OrFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.OR_FILTER;
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    for (PermissionFilter operand : getOperands())
+    {
+      if (operand.isApplicable(revision, revisionProvider, securityContext))
+      {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  @Override
+  protected String formatOperator()
+  {
+    return "Or";
+  }
+
+} // OrFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackageFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackageFilterImpl.java
new file mode 100644
index 0000000000..f187946057
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackageFilterImpl.java
@@ -0,0 +1,91 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.security.PackageFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+import org.eclipse.emf.ecore.EPackage;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Package Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.PackageFilterImpl#getApplicablePackage <em>Applicable Package</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public class PackageFilterImpl extends PermissionFilterImpl implements PackageFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected PackageFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.PACKAGE_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EPackage getApplicablePackage()
+  {
+    return (EPackage)eGet(SecurityPackage.Literals.PACKAGE_FILTER__APPLICABLE_PACKAGE, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setApplicablePackage(EPackage newApplicablePackage)
+  {
+    eSet(SecurityPackage.Literals.PACKAGE_FILTER__APPLICABLE_PACKAGE, newApplicablePackage);
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    EPackage actualPackage = revision.getEClass().getEPackage();
+    EPackage applicablePackage = getApplicablePackage();
+    return actualPackage == applicablePackage;
+  }
+
+  public String format()
+  {
+    String label = "?";
+
+    EPackage applicablePackage = getApplicablePackage();
+    if (applicablePackage != null)
+    {
+      label = applicablePackage.getName();
+    }
+
+    return "package==" + label;
+  }
+
+} // PackageFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackagePermissionImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackagePermissionImpl.java
index b3b71b874b..5cb2053909 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackagePermissionImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PackagePermissionImpl.java
@@ -32,6 +32,7 @@ import org.eclipse.emf.ecore.EPackage;
  *
  * @generated
  */
+@Deprecated
 public class PackagePermissionImpl extends PermissionImpl implements PackagePermission
 {
   /**
@@ -75,9 +76,6 @@ public class PackagePermissionImpl extends PermissionImpl implements PackagePerm
     eSet(SecurityPackage.Literals.PACKAGE_PERMISSION__APPLICABLE_PACKAGE, newApplicablePackage);
   }
 
-  /**
-   * @ADDED
-   */
   public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
   {
     EPackage actualPackage = revision.getEClass().getEPackage();
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PermissionFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PermissionFilterImpl.java
new file mode 100644
index 0000000000..e9e7afda91
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/PermissionFilterImpl.java
@@ -0,0 +1,56 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.security.PermissionFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.internal.cdo.CDOObjectImpl;
+
+import org.eclipse.emf.ecore.EClass;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Permission Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * </p>
+ *
+ * @generated
+ */
+public abstract class PermissionFilterImpl extends CDOObjectImpl implements PermissionFilter
+{
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected PermissionFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.PERMISSION_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected int eStaticFeatureCount()
+  {
+    return 0;
+  }
+
+} // PermissionFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/RealmImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/RealmImpl.java
index 31eba7cf19..39ae86b3d2 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/RealmImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/RealmImpl.java
@@ -21,6 +21,7 @@ import org.eclipse.emf.cdo.security.SecurityFactory;
 import org.eclipse.emf.cdo.security.SecurityItem;
 import org.eclipse.emf.cdo.security.SecurityPackage;
 import org.eclipse.emf.cdo.security.User;
+import org.eclipse.emf.cdo.security.UserPassword;
 
 import org.eclipse.emf.common.util.EList;
 import org.eclipse.emf.ecore.EClass;
@@ -421,6 +422,23 @@ public class RealmImpl extends SecurityElementImpl implements Realm
   }
 
   /**
+   * @since 4.3
+   */
+  public User setPassword(String id, String password)
+  {
+    UserPassword userPassword = null;
+    if (password != null && password.length() != 0)
+    {
+      userPassword = SecurityFactory.eINSTANCE.createUserPassword();
+      userPassword.setEncrypted(password);
+    }
+
+    User user = getUser(id);
+    user.setPassword(userPassword);
+    return user;
+  }
+
+  /**
    * @since 4.2
    */
   public Role removeRole(String id)
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourceFilterImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourceFilterImpl.java
new file mode 100644
index 0000000000..ea4c3ca5e0
--- /dev/null
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourceFilterImpl.java
@@ -0,0 +1,262 @@
+/**
+ */
+package org.eclipse.emf.cdo.security.impl;
+
+import org.eclipse.emf.cdo.common.branch.CDOBranchPoint;
+import org.eclipse.emf.cdo.common.revision.CDORevision;
+import org.eclipse.emf.cdo.common.revision.CDORevisionProvider;
+import org.eclipse.emf.cdo.common.revision.CDORevisionUtil;
+import org.eclipse.emf.cdo.security.Inclusion;
+import org.eclipse.emf.cdo.security.ResourceFilter;
+import org.eclipse.emf.cdo.security.SecurityPackage;
+
+import org.eclipse.emf.ecore.EClass;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
+
+/**
+ * <!-- begin-user-doc -->
+ * An implementation of the model object '<em><b>Resource Filter</b></em>'.
+ * @since 4.3
+ * <!-- end-user-doc -->
+ * <p>
+ * The following features are implemented:
+ * <ul>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.ResourceFilterImpl#getPath <em>Path</em>}</li>
+ *   <li>{@link org.eclipse.emf.cdo.security.impl.ResourceFilterImpl#getInclusion <em>Inclusion</em>}</li>
+ * </ul>
+ * </p>
+ *
+ * @generated
+ */
+public class ResourceFilterImpl extends PermissionFilterImpl implements ResourceFilter
+{
+  private static final Pattern OMNI_PATTERN = Pattern.compile(".*");
+
+  private Pattern pattern;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  protected ResourceFilterImpl()
+  {
+    super();
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  @Override
+  protected EClass eStaticClass()
+  {
+    return SecurityPackage.Literals.RESOURCE_FILTER;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public String getPath()
+  {
+    return (String)eGet(SecurityPackage.Literals.RESOURCE_FILTER__PATH, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setPath(String newPath)
+  {
+    eSet(SecurityPackage.Literals.RESOURCE_FILTER__PATH, newPath);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public Inclusion getInclusion()
+  {
+    return (Inclusion)eGet(SecurityPackage.Literals.RESOURCE_FILTER__INCLUSION, true);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public void setInclusion(Inclusion newInclusion)
+  {
+    eSet(SecurityPackage.Literals.RESOURCE_FILTER__INCLUSION, newInclusion);
+  }
+
+  public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
+  {
+    if (revisionProvider == null)
+    {
+      return false;
+    }
+
+    Inclusion inclusion = getInclusion();
+    switch (inclusion)
+    {
+    case EXACT:
+      return includesExact(revision, revisionProvider);
+
+    case EXACT_AND_UP:
+      return includesExactAndUp(revision, revisionProvider);
+
+    case EXACT_AND_DOWN:
+      return includesExactAndDown(revision, revisionProvider);
+
+    case REGEX:
+      return includesRegex(revision, revisionProvider);
+
+    default:
+      throw new IllegalStateException("Unhandled inclusion value: " + inclusion);
+    }
+  }
+
+  private boolean includesExact(CDORevision revision, CDORevisionProvider revisionProvider)
+  {
+    if (!revision.isResourceNode())
+    {
+      return false;
+    }
+
+    String revisionPath = CDORevisionUtil.getResourceNodePath(revision, revisionProvider);
+    String path = getPath();
+
+    return revisionPath.equals(path);
+  }
+
+  private boolean includesExactAndUp(CDORevision revision, CDORevisionProvider revisionProvider)
+  {
+    if (!revision.isResourceNode())
+    {
+      return false;
+    }
+
+    String revisionPath = CDORevisionUtil.getResourceNodePath(revision, revisionProvider);
+    String path = getPath();
+
+    int length = revisionPath.length();
+    if (length > path.length())
+    {
+      return false;
+    }
+
+    path = path.substring(0, length);
+    return revisionPath.equals(path);
+  }
+
+  private boolean includesExactAndDown(CDORevision revision, CDORevisionProvider revisionProvider)
+  {
+    String revisionPath = CDORevisionUtil.getResourceNodePath(revision, revisionProvider);
+    String path = getPath();
+
+    int length = revisionPath.length();
+    if (length < path.length())
+    {
+      return false;
+    }
+
+    revisionPath = revisionPath.substring(0, length);
+    return revisionPath.equals(path);
+  }
+
+  private boolean includesRegex(CDORevision revision, CDORevisionProvider revisionProvider)
+  {
+    if (pattern == null)
+    {
+      String path = getPath();
+      pattern = compilePattern(path);
+
+      if (pattern == null)
+      {
+        return false;
+      }
+    }
+
+    if (pattern == OMNI_PATTERN)
+    {
+      return true;
+    }
+
+    String revisionPath = CDORevisionUtil.getResourceNodePath(revision, revisionProvider);
+
+    Matcher matcher = pattern.matcher(revisionPath);
+    return matcher.matches();
+  }
+
+  private Pattern compilePattern(String value)
+  {
+    if (value == null)
+    {
+      return null;
+    }
+
+    if (value.equals(OMNI_PATTERN.pattern()))
+    {
+      return OMNI_PATTERN;
+    }
+
+    try
+    {
+      return Pattern.compile(value);
+    }
+    catch (PatternSyntaxException ex)
+    {
+      return null;
+    }
+  }
+
+  public String format()
+  {
+    String label = "?";
+
+    String path = getPath();
+    if (path != null)
+    {
+      if (path.startsWith("/"))
+      {
+        path = path.substring(1);
+      }
+
+      label = path;
+    }
+
+    String operator = formatOperator();
+    return "resource" + operator + label;
+  }
+
+  private String formatOperator()
+  {
+    Inclusion inclusion = getInclusion();
+    switch (inclusion)
+    {
+    case EXACT:
+      return "==";
+
+    case EXACT_AND_UP:
+      return "<=";
+
+    case EXACT_AND_DOWN:
+      return ">=";
+
+    case REGEX:
+      return "~>";
+
+    default:
+      throw new IllegalStateException("Unhandled inclusion value: " + inclusion);
+    }
+  }
+} // ResourceFilterImpl
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourcePermissionImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourcePermissionImpl.java
index f65f803d12..989a165a8d 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourcePermissionImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/ResourcePermissionImpl.java
@@ -36,16 +36,11 @@ import java.util.regex.PatternSyntaxException;
  *
  * @generated
  */
+@Deprecated
 public class ResourcePermissionImpl extends PermissionImpl implements ResourcePermission
 {
-  /**
-   * @ADDED
-   */
   private static final Pattern OMNI_PATTERN = Pattern.compile(".*");
 
-  /**
-   * @ADDED
-   */
   private Pattern pattern;
 
   /**
@@ -89,9 +84,6 @@ public class ResourcePermissionImpl extends PermissionImpl implements ResourcePe
     eSet(SecurityPackage.Literals.RESOURCE_PERMISSION__PATTERN, newPattern);
   }
 
-  /**
-   * @ADDED
-   */
   public boolean isApplicable(CDORevision revision, CDORevisionProvider revisionProvider, CDOBranchPoint securityContext)
   {
     if (pattern == null)
@@ -121,9 +113,6 @@ public class ResourcePermissionImpl extends PermissionImpl implements ResourcePe
     return matcher.matches();
   }
 
-  /**
-   * @ADDED
-   */
   private Pattern compilePattern(String value)
   {
     if (value == null)
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java
index d2e687e2f0..52a9002f69 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityFactoryImpl.java
@@ -11,12 +11,24 @@
 package org.eclipse.emf.cdo.security.impl;
 
 //import org.eclipse.emf.cdo.security.*;
+import org.eclipse.emf.cdo.expressions.Expression;
 import org.eclipse.emf.cdo.security.Access;
+import org.eclipse.emf.cdo.security.AndFilter;
+import org.eclipse.emf.cdo.security.ClassFilter;
 import org.eclipse.emf.cdo.security.ClassPermission;
 import org.eclipse.emf.cdo.security.Directory;
+import org.eclipse.emf.cdo.security.ExpressionFilter;
+import org.eclipse.emf.cdo.security.FilterPermission;
 import org.eclipse.emf.cdo.security.Group;
+import org.eclipse.emf.cdo.security.Inclusion;
+import org.eclipse.emf.cdo.security.LinkedFilter;
+import org.eclipse.emf.cdo.security.NotFilter;
+import org.eclipse.emf.cdo.security.OrFilter;
+import org.eclipse.emf.cdo.security.PackageFilter;
 import org.eclipse.emf.cdo.security.PackagePermission;
+import org.eclipse.emf.cdo.security.PermissionFilter;
 import org.eclipse.emf.cdo.security.Realm;
+import org.eclipse.emf.cdo.security.ResourceFilter;
 import org.eclipse.emf.cdo.security.ResourcePermission;
 import org.eclipse.emf.cdo.security.Role;
 import org.eclipse.emf.cdo.security.SecurityFactory;
@@ -31,15 +43,23 @@ import org.eclipse.emf.ecore.EPackage;
 import org.eclipse.emf.ecore.impl.EFactoryImpl;
 import org.eclipse.emf.ecore.plugin.EcorePlugin;
 
+import java.util.Arrays;
+
 /**
  * <!-- begin-user-doc -->
  * An implementation of the model <b>Factory</b>.
  * <!-- end-user-doc -->
  * @generated
  */
+@SuppressWarnings("deprecation")
 public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
 {
   /**
+   * @since 4.3
+   */
+  public static final Access DEFAULT_PERMISSION = Access.WRITE;
+
+  /**
    * Creates the default factory implementation.
    * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
@@ -50,7 +70,7 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
     try
     {
       SecurityFactory theSecurityFactory = (SecurityFactory)EPackage.Registry.INSTANCE
-          .getEFactory("http://www.eclipse.org/emf/CDO/security/4.1.0"); //$NON-NLS-1$ 
+          .getEFactory(SecurityPackage.eNS_URI);
       if (theSecurityFactory != null)
       {
         return theSecurityFactory;
@@ -102,6 +122,24 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
       return (EObject)createPackagePermission();
     case SecurityPackage.RESOURCE_PERMISSION:
       return (EObject)createResourcePermission();
+    case SecurityPackage.FILTER_PERMISSION:
+      return (EObject)createFilterPermission();
+    case SecurityPackage.LINKED_FILTER:
+      return (EObject)createLinkedFilter();
+    case SecurityPackage.PACKAGE_FILTER:
+      return (EObject)createPackageFilter();
+    case SecurityPackage.CLASS_FILTER:
+      return (EObject)createClassFilter();
+    case SecurityPackage.RESOURCE_FILTER:
+      return (EObject)createResourceFilter();
+    case SecurityPackage.EXPRESSION_FILTER:
+      return (EObject)createExpressionFilter();
+    case SecurityPackage.NOT_FILTER:
+      return (EObject)createNotFilter();
+    case SecurityPackage.AND_FILTER:
+      return (EObject)createAndFilter();
+    case SecurityPackage.OR_FILTER:
+      return (EObject)createOrFilter();
     default:
       throw new IllegalArgumentException("The class '" + eClass.getName() + "' is not a valid classifier"); //$NON-NLS-1$ //$NON-NLS-2$
     }
@@ -117,6 +155,8 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
   {
     switch (eDataType.getClassifierID())
     {
+    case SecurityPackage.INCLUSION:
+      return createInclusionFromString(eDataType, initialValue);
     case SecurityPackage.ACCESS:
       return createAccessFromString(eDataType, initialValue);
     case SecurityPackage.ACCESS_OBJECT:
@@ -136,6 +176,8 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
   {
     switch (eDataType.getClassifierID())
     {
+    case SecurityPackage.INCLUSION:
+      return convertInclusionToString(eDataType, instanceValue);
     case SecurityPackage.ACCESS:
       return convertAccessToString(eDataType, instanceValue);
     case SecurityPackage.ACCESS_OBJECT:
@@ -208,25 +250,28 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
     return user;
   }
 
-  public ClassPermission createClassPermission(EClass eClass, Access access)
+  @Deprecated
+  public org.eclipse.emf.cdo.security.ClassPermission createClassPermission(EClass eClass, Access access)
   {
-    ClassPermission permission = createClassPermission();
+    org.eclipse.emf.cdo.security.ClassPermission permission = createClassPermission();
     permission.setApplicableClass(eClass);
     permission.setAccess(access);
     return permission;
   }
 
-  public PackagePermission createPackagePermission(EPackage ePackage, Access access)
+  @Deprecated
+  public org.eclipse.emf.cdo.security.PackagePermission createPackagePermission(EPackage ePackage, Access access)
   {
-    PackagePermission permission = createPackagePermission();
+    org.eclipse.emf.cdo.security.PackagePermission permission = createPackagePermission();
     permission.setApplicablePackage(ePackage);
     permission.setAccess(access);
     return permission;
   }
 
-  public ResourcePermission createResourcePermission(String pattern, Access access)
+  @Deprecated
+  public org.eclipse.emf.cdo.security.ResourcePermission createResourcePermission(String pattern, Access access)
   {
-    ResourcePermission permission = createResourcePermission();
+    org.eclipse.emf.cdo.security.ResourcePermission permission = createResourcePermission();
     permission.setPattern(pattern);
     permission.setAccess(access);
     return permission;
@@ -292,6 +337,7 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   public ClassPermission createClassPermission()
   {
     ClassPermissionImpl classPermission = new ClassPermissionImpl();
@@ -303,6 +349,7 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   public PackagePermission createPackagePermission()
   {
     PackagePermissionImpl packagePermission = new PackagePermissionImpl();
@@ -314,6 +361,7 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
    * <!-- end-user-doc -->
    * @generated
    */
+  @Deprecated
   public ResourcePermission createResourcePermission()
   {
     ResourcePermissionImpl resourcePermission = new ResourcePermissionImpl();
@@ -322,6 +370,231 @@ public class SecurityFactoryImpl extends EFactoryImpl implements SecurityFactory
 
   /**
    * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public FilterPermission createFilterPermission()
+  {
+    FilterPermissionImpl filterPermission = new FilterPermissionImpl();
+    return filterPermission;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public LinkedFilter createLinkedFilter()
+  {
+    LinkedFilterImpl linkedFilter = new LinkedFilterImpl();
+    return linkedFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public FilterPermission createFilterPermission(Access access, PermissionFilter... filters)
+  {
+    FilterPermission permission = createFilterPermission();
+    permission.setAccess(access);
+    permission.getFilters().addAll(Arrays.asList(filters));
+    return permission;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public PackageFilter createPackageFilter()
+  {
+    PackageFilterImpl packageFilter = new PackageFilterImpl();
+    return packageFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public PackageFilter createPackageFilter(EPackage ePackage)
+  {
+    PackageFilter filter = createPackageFilter();
+    filter.setApplicablePackage(ePackage);
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ClassFilter createClassFilter()
+  {
+    ClassFilterImpl classFilter = new ClassFilterImpl();
+    return classFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public ClassFilter createClassFilter(EClass eClass)
+  {
+    ClassFilter filter = createClassFilter();
+    filter.setApplicableClass(eClass);
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ResourceFilter createResourceFilter()
+  {
+    ResourceFilterImpl resourceFilter = new ResourceFilterImpl();
+    return resourceFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public ResourceFilter createResourceFilter(String path)
+  {
+    ResourceFilter filter = createResourceFilter();
+    filter.setPath(path);
+    return filter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public ResourceFilter createResourceFilter(String path, Inclusion inclusion)
+  {
+    ResourceFilter filter = createResourceFilter(path);
+    filter.setInclusion(inclusion);
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public ExpressionFilter createExpressionFilter()
+  {
+    ExpressionFilterImpl expressionFilter = new ExpressionFilterImpl();
+    return expressionFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public ExpressionFilter createExpressionFilter(Expression expression)
+  {
+    ExpressionFilter filter = createExpressionFilter();
+    filter.setExpression(expression);
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public NotFilter createNotFilter()
+  {
+    NotFilterImpl notFilter = new NotFilterImpl();
+    return notFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public NotFilter createNotFilter(PermissionFilter operand)
+  {
+    NotFilter filter = createNotFilter();
+    filter.getOperands().add(operand);
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public AndFilter createAndFilter()
+  {
+    AndFilterImpl andFilter = new AndFilterImpl();
+    return andFilter;
+  }
+
+  /**
+   * @since 4.3
+   */
+  public AndFilter createAndFilter(PermissionFilter... operands)
+  {
+    AndFilter filter = createAndFilter();
+    filter.getOperands().addAll(Arrays.asList(operands));
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public OrFilter createOrFilter()
+  {
+    OrFilterImpl orFilter = new OrFilterImpl();
+    return orFilter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public Inclusion createInclusionFromString(EDataType eDataType, String initialValue)
+  {
+    Inclusion result = Inclusion.get(initialValue);
+    if (result == null)
+      throw new IllegalArgumentException(
+          "The value '" + initialValue + "' is not a valid enumerator of '" + eDataType.getName() + "'"); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+    return result;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public String convertInclusionToString(EDataType eDataType, Object instanceValue)
+  {
+    return instanceValue == null ? null : instanceValue.toString();
+  }
+
+  /**
+   * @since 4.3
+   */
+  public OrFilter createOrFilter(PermissionFilter... operands)
+  {
+    OrFilter filter = createOrFilter();
+    filter.getOperands().addAll(Arrays.asList(operands));
+    return filter;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
    * @generated
    */
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java
index 4c3c4273fd..ac61669c6e 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/impl/SecurityPackageImpl.java
@@ -11,15 +11,29 @@
 package org.eclipse.emf.cdo.security.impl;
 
 import org.eclipse.emf.cdo.etypes.EtypesPackage;
+import org.eclipse.emf.cdo.expressions.ExpressionsPackage;
 import org.eclipse.emf.cdo.security.Access;
+import org.eclipse.emf.cdo.security.AndFilter;
 import org.eclipse.emf.cdo.security.Assignee;
+import org.eclipse.emf.cdo.security.ClassFilter;
 import org.eclipse.emf.cdo.security.ClassPermission;
+import org.eclipse.emf.cdo.security.CombinedFilter;
 import org.eclipse.emf.cdo.security.Directory;
+import org.eclipse.emf.cdo.security.ExpressionFilter;
+import org.eclipse.emf.cdo.security.FilterPermission;
 import org.eclipse.emf.cdo.security.Group;
+import org.eclipse.emf.cdo.security.Inclusion;
+import org.eclipse.emf.cdo.security.LinkedFilter;
+import org.eclipse.emf.cdo.security.NotFilter;
+import org.eclipse.emf.cdo.security.ObjectFilter;
 import org.eclipse.emf.cdo.security.ObjectPermission;
+import org.eclipse.emf.cdo.security.OrFilter;
+import org.eclipse.emf.cdo.security.PackageFilter;
 import org.eclipse.emf.cdo.security.PackagePermission;
 import org.eclipse.emf.cdo.security.Permission;
+import org.eclipse.emf.cdo.security.PermissionFilter;
 import org.eclipse.emf.cdo.security.Realm;
+import org.eclipse.emf.cdo.security.ResourceFilter;
 import org.eclipse.emf.cdo.security.ResourcePermission;
 import org.eclipse.emf.cdo.security.Role;
 import org.eclipse.emf.cdo.security.SecurityElement;
@@ -44,6 +58,7 @@ import org.eclipse.emf.ecore.impl.EPackageImpl;
  * <!-- end-user-doc -->
  * @generated
  */
+@SuppressWarnings("deprecation")
 public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 {
   /**
@@ -149,6 +164,97 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    * <!-- end-user-doc -->
    * @generated
    */
+  private EClass filterPermissionEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass permissionFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass linkedFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass packageFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass classFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass resourceFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass objectFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass expressionFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass combinedFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass notFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass andFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EClass orFilterEClass = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  private EEnum inclusionEEnum = null;
+
+  /**
+   * <!-- begin-user-doc -->
+   * <!-- end-user-doc -->
+   * @generated
+   */
   private EEnum accessEEnum = null;
 
   /**
@@ -187,7 +293,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
   /**
    * Creates, registers, and initializes the <b>Package</b> for this model, and for any others upon which it depends.
-   *
+   * 
    * <p>This method is used to initialize {@link SecurityPackage#eINSTANCE} when that field is accessed.
    * Clients should not invoke it directly. Instead, they should simply access that field to obtain the package.
    * <!-- begin-user-doc -->
@@ -200,9 +306,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
   public static SecurityPackage init()
   {
     if (isInited)
-    {
       return (SecurityPackage)EPackage.Registry.INSTANCE.getEPackage(SecurityPackage.eNS_URI);
-    }
 
     // Obtain or create and register package
     SecurityPackageImpl theSecurityPackage = (SecurityPackageImpl)(EPackage.Registry.INSTANCE.get(eNS_URI) instanceof SecurityPackageImpl ? EPackage.Registry.INSTANCE
@@ -212,6 +316,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
     // Initialize simple dependencies
     EtypesPackage.eINSTANCE.eClass();
+    ExpressionsPackage.eINSTANCE.eClass();
 
     // Create package meta-data objects
     theSecurityPackage.createPackageContents();
@@ -793,6 +898,248 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
   /**
    * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getFilterPermission()
+  {
+    return filterPermissionEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getFilterPermission_Filters()
+  {
+    return (EReference)filterPermissionEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getPermissionFilter()
+  {
+    return permissionFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getLinkedFilter()
+  {
+    return linkedFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getLinkedFilter_Filter()
+  {
+    return (EReference)linkedFilterEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getPackageFilter()
+  {
+    return packageFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getPackageFilter_ApplicablePackage()
+  {
+    return (EReference)packageFilterEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getClassFilter()
+  {
+    return classFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getClassFilter_ApplicableClass()
+  {
+    return (EReference)classFilterEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EAttribute getClassFilter_SubTypes()
+  {
+    return (EAttribute)classFilterEClass.getEStructuralFeatures().get(1);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getResourceFilter()
+  {
+    return resourceFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EAttribute getResourceFilter_Path()
+  {
+    return (EAttribute)resourceFilterEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EAttribute getResourceFilter_Inclusion()
+  {
+    return (EAttribute)resourceFilterEClass.getEStructuralFeatures().get(1);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getObjectFilter()
+  {
+    return objectFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getExpressionFilter()
+  {
+    return expressionFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getExpressionFilter_Expression()
+  {
+    return (EReference)expressionFilterEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getCombinedFilter()
+  {
+    return combinedFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EReference getCombinedFilter_Operands()
+  {
+    return (EReference)combinedFilterEClass.getEStructuralFeatures().get(0);
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getNotFilter()
+  {
+    return notFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getAndFilter()
+  {
+    return andFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EClass getOrFilter()
+  {
+    return orFilterEClass;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @generated
+   */
+  public EEnum getInclusion()
+  {
+    return inclusionEEnum;
+  }
+
+  /**
+   * <!-- begin-user-doc -->
    * <!-- end-user-doc -->
    * @generated
    */
@@ -838,9 +1185,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
   public void createPackageContents()
   {
     if (isCreated)
-    {
       return;
-    }
     isCreated = true;
 
     // Create classes and their features
@@ -914,7 +1259,41 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
     objectPermissionEClass = createEClass(OBJECT_PERMISSION);
 
+    filterPermissionEClass = createEClass(FILTER_PERMISSION);
+    createEReference(filterPermissionEClass, FILTER_PERMISSION__FILTERS);
+
+    permissionFilterEClass = createEClass(PERMISSION_FILTER);
+
+    linkedFilterEClass = createEClass(LINKED_FILTER);
+    createEReference(linkedFilterEClass, LINKED_FILTER__FILTER);
+
+    packageFilterEClass = createEClass(PACKAGE_FILTER);
+    createEReference(packageFilterEClass, PACKAGE_FILTER__APPLICABLE_PACKAGE);
+
+    classFilterEClass = createEClass(CLASS_FILTER);
+    createEReference(classFilterEClass, CLASS_FILTER__APPLICABLE_CLASS);
+    createEAttribute(classFilterEClass, CLASS_FILTER__SUB_TYPES);
+
+    resourceFilterEClass = createEClass(RESOURCE_FILTER);
+    createEAttribute(resourceFilterEClass, RESOURCE_FILTER__PATH);
+    createEAttribute(resourceFilterEClass, RESOURCE_FILTER__INCLUSION);
+
+    objectFilterEClass = createEClass(OBJECT_FILTER);
+
+    expressionFilterEClass = createEClass(EXPRESSION_FILTER);
+    createEReference(expressionFilterEClass, EXPRESSION_FILTER__EXPRESSION);
+
+    combinedFilterEClass = createEClass(COMBINED_FILTER);
+    createEReference(combinedFilterEClass, COMBINED_FILTER__OPERANDS);
+
+    notFilterEClass = createEClass(NOT_FILTER);
+
+    andFilterEClass = createEClass(AND_FILTER);
+
+    orFilterEClass = createEClass(OR_FILTER);
+
     // Create enums
+    inclusionEEnum = createEEnum(INCLUSION);
     accessEEnum = createEEnum(ACCESS);
 
     // Create data types
@@ -938,9 +1317,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
   public void initializePackageContents()
   {
     if (isInitialized)
-    {
       return;
-    }
     isInitialized = true;
 
     // Initialize package
@@ -951,6 +1328,8 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     // Obtain other dependent packages
     EtypesPackage theEtypesPackage = (EtypesPackage)EPackage.Registry.INSTANCE.getEPackage(EtypesPackage.eNS_URI);
     EcorePackage theEcorePackage = (EcorePackage)EPackage.Registry.INSTANCE.getEPackage(EcorePackage.eNS_URI);
+    ExpressionsPackage theExpressionsPackage = (ExpressionsPackage)EPackage.Registry.INSTANCE
+        .getEPackage(ExpressionsPackage.eNS_URI);
 
     // Create type parameters
 
@@ -958,23 +1337,34 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
 
     // Add supertypes to classes
     securityElementEClass.getESuperTypes().add(theEtypesPackage.getModelElement());
-    securityItemEClass.getESuperTypes().add(getSecurityElement());
-    realmEClass.getESuperTypes().add(getSecurityElement());
-    directoryEClass.getESuperTypes().add(getSecurityItem());
-    roleEClass.getESuperTypes().add(getSecurityItem());
-    assigneeEClass.getESuperTypes().add(getSecurityItem());
-    groupEClass.getESuperTypes().add(getAssignee());
-    userEClass.getESuperTypes().add(getAssignee());
-    classPermissionEClass.getESuperTypes().add(getPermission());
-    packagePermissionEClass.getESuperTypes().add(getPermission());
-    resourcePermissionEClass.getESuperTypes().add(getPermission());
-    objectPermissionEClass.getESuperTypes().add(getPermission());
+    securityItemEClass.getESuperTypes().add(this.getSecurityElement());
+    realmEClass.getESuperTypes().add(this.getSecurityElement());
+    directoryEClass.getESuperTypes().add(this.getSecurityItem());
+    roleEClass.getESuperTypes().add(this.getSecurityItem());
+    assigneeEClass.getESuperTypes().add(this.getSecurityItem());
+    groupEClass.getESuperTypes().add(this.getAssignee());
+    userEClass.getESuperTypes().add(this.getAssignee());
+    classPermissionEClass.getESuperTypes().add(this.getPermission());
+    packagePermissionEClass.getESuperTypes().add(this.getPermission());
+    resourcePermissionEClass.getESuperTypes().add(this.getPermission());
+    objectPermissionEClass.getESuperTypes().add(this.getPermission());
+    filterPermissionEClass.getESuperTypes().add(this.getPermission());
+    linkedFilterEClass.getESuperTypes().add(this.getPermissionFilter());
+    packageFilterEClass.getESuperTypes().add(this.getPermissionFilter());
+    classFilterEClass.getESuperTypes().add(this.getPermissionFilter());
+    resourceFilterEClass.getESuperTypes().add(this.getPermissionFilter());
+    objectFilterEClass.getESuperTypes().add(this.getPermissionFilter());
+    expressionFilterEClass.getESuperTypes().add(this.getObjectFilter());
+    combinedFilterEClass.getESuperTypes().add(this.getPermissionFilter());
+    notFilterEClass.getESuperTypes().add(this.getCombinedFilter());
+    andFilterEClass.getESuperTypes().add(this.getCombinedFilter());
+    orFilterEClass.getESuperTypes().add(this.getCombinedFilter());
 
     // Initialize classes and features; add operations and parameters
     initEClass(securityElementEClass, SecurityElement.class,
         "SecurityElement", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
 
-    addEOperation(securityElementEClass, getRealm(), "getRealm", 1, 1, IS_UNIQUE, IS_ORDERED); //$NON-NLS-1$
+    addEOperation(securityElementEClass, this.getRealm(), "getRealm", 1, 1, IS_UNIQUE, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(securityItemEClass, SecurityItem.class,
         "SecurityItem", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
@@ -982,27 +1372,27 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(realmEClass, Realm.class, "Realm", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getRealm_Items(),
-        getSecurityItem(),
+        this.getSecurityItem(),
         null,
         "items", null, 0, -1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_AllUsers(),
-        getUser(),
+        this.getUser(),
         null,
         "allUsers", null, 0, -1, Realm.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_AllGroups(),
-        getGroup(),
+        this.getGroup(),
         null,
         "allGroups", null, 0, -1, Realm.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_AllRoles(),
-        getRole(),
+        this.getRole(),
         null,
         "allRoles", null, 0, -1, Realm.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_AllPermissions(),
-        getPermission(),
+        this.getPermission(),
         null,
         "allPermissions", null, 0, -1, Realm.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
@@ -1011,28 +1401,28 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "name", null, 0, 1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getRealm_DefaultAccess(),
-        getAccessObject(),
+        this.getAccessObject(),
         "defaultAccess", null, 0, 1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_DefaultUserDirectory(),
-        getDirectory(),
+        this.getDirectory(),
         null,
         "defaultUserDirectory", null, 0, 1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_DefaultGroupDirectory(),
-        getDirectory(),
+        this.getDirectory(),
         null,
         "defaultGroupDirectory", null, 0, 1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRealm_DefaultRoleDirectory(),
-        getDirectory(),
+        this.getDirectory(),
         null,
         "defaultRoleDirectory", null, 0, 1, Realm.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(directoryEClass, Directory.class, "Directory", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getDirectory_Items(),
-        getSecurityItem(),
+        this.getSecurityItem(),
         null,
         "items", null, 0, -1, Directory.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
@@ -1047,13 +1437,13 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "id", null, 0, 1, Role.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRole_Permissions(),
-        getPermission(),
-        getPermission_Role(),
+        this.getPermission(),
+        this.getPermission_Role(),
         "permissions", null, 0, -1, Role.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getRole_Assignees(),
-        getAssignee(),
-        getAssignee_Roles(),
+        this.getAssignee(),
+        this.getAssignee_Roles(),
         "assignees", null, 0, -1, Role.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(assigneeEClass, Assignee.class, "Assignee", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
@@ -1063,47 +1453,47 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "id", null, 0, 1, Assignee.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getAssignee_Roles(),
-        getRole(),
-        getRole_Assignees(),
+        this.getRole(),
+        this.getRole_Assignees(),
         "roles", null, 0, -1, Assignee.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(groupEClass, Group.class, "Group", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getGroup_Users(),
-        getUser(),
-        getUser_Groups(),
+        this.getUser(),
+        this.getUser_Groups(),
         "users", null, 0, -1, Group.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getGroup_InheritedGroups(),
-        getGroup(),
-        getGroup_InheritingGroups(),
+        this.getGroup(),
+        this.getGroup_InheritingGroups(),
         "inheritedGroups", null, 0, -1, Group.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getGroup_InheritingGroups(),
-        getGroup(),
-        getGroup_InheritedGroups(),
+        this.getGroup(),
+        this.getGroup_InheritedGroups(),
         "inheritingGroups", null, 0, -1, Group.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getGroup_AllInheritedGroups(),
-        getGroup(),
+        this.getGroup(),
         null,
         "allInheritedGroups", null, 0, -1, Group.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getGroup_AllInheritingGroups(),
-        getGroup(),
+        this.getGroup(),
         null,
         "allInheritingGroups", null, 0, -1, Group.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getGroup_AllRoles(),
-        getRole(),
+        this.getRole(),
         null,
         "allRoles", null, 0, -1, Group.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
     initEClass(userEClass, User.class, "User", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getUser_Groups(),
-        getGroup(),
-        getGroup_Users(),
+        this.getGroup(),
+        this.getGroup_Users(),
         "groups", null, 0, -1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getUser_Label(),
@@ -1123,11 +1513,11 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "email", null, 0, 1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getUser_DefaultAccessOverride(),
-        getAccessObject(),
+        this.getAccessObject(),
         "defaultAccessOverride", null, 0, 1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getUser_DefaultAccess(),
-        getAccessObject(),
+        this.getAccessObject(),
         "defaultAccess", null, 0, 1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getUser_Locked(),
@@ -1135,27 +1525,27 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "locked", null, 0, 1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getUser_Password(),
-        getUserPassword(),
+        this.getUserPassword(),
         null,
         "password", null, 0, 1, User.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getUser_AllGroups(),
-        getGroup(),
+        this.getGroup(),
         null,
         "allGroups", null, 0, -1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getUser_AllRoles(),
-        getRole(),
+        this.getRole(),
         null,
         "allRoles", null, 0, -1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getUser_AllPermissions(),
-        getPermission(),
+        this.getPermission(),
         null,
         "allPermissions", null, 0, -1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEReference(
         getUser_UnassignedRoles(),
-        getRole(),
+        this.getRole(),
         null,
         "unassignedRoles", null, 0, -1, User.class, IS_TRANSIENT, IS_VOLATILE, !IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
 
@@ -1170,12 +1560,12 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
         "Permission", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
     initEReference(
         getPermission_Role(),
-        getRole(),
-        getRole_Permissions(),
+        this.getRole(),
+        this.getRole_Permissions(),
         "role", null, 1, 1, Permission.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
     initEAttribute(
         getPermission_Access(),
-        getAccess(),
+        this.getAccess(),
         "access", "WRITE", 1, 1, Permission.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$ //$NON-NLS-2$
 
     initEClass(classPermissionEClass, ClassPermission.class,
@@ -1204,7 +1594,88 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
     initEClass(objectPermissionEClass, ObjectPermission.class,
         "ObjectPermission", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
 
+    initEClass(filterPermissionEClass, FilterPermission.class,
+        "FilterPermission", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEReference(
+        getFilterPermission_Filters(),
+        this.getPermissionFilter(),
+        null,
+        "filters", null, 1, -1, FilterPermission.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+
+    initEClass(permissionFilterEClass, PermissionFilter.class,
+        "PermissionFilter", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+
+    initEClass(linkedFilterEClass, LinkedFilter.class,
+        "LinkedFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEReference(
+        getLinkedFilter_Filter(),
+        this.getPermissionFilter(),
+        null,
+        "filter", null, 1, 1, LinkedFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+
+    initEClass(packageFilterEClass, PackageFilter.class,
+        "PackageFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEReference(
+        getPackageFilter_ApplicablePackage(),
+        theEcorePackage.getEPackage(),
+        null,
+        "applicablePackage", null, 1, 1, PackageFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+
+    initEClass(classFilterEClass, ClassFilter.class,
+        "ClassFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEReference(
+        getClassFilter_ApplicableClass(),
+        theEcorePackage.getEClass(),
+        null,
+        "applicableClass", null, 1, 1, ClassFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_COMPOSITE, IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEAttribute(
+        getClassFilter_SubTypes(),
+        theEcorePackage.getEBoolean(),
+        "subTypes", "true", 0, 1, ClassFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$ //$NON-NLS-2$
+
+    initEClass(resourceFilterEClass, ResourceFilter.class,
+        "ResourceFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEAttribute(
+        getResourceFilter_Path(),
+        theEcorePackage.getEString(),
+        "path", null, 0, 1, ResourceFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+    initEAttribute(
+        getResourceFilter_Inclusion(),
+        this.getInclusion(),
+        "inclusion", "Regex", 0, 1, ResourceFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, !IS_UNSETTABLE, !IS_ID, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$ //$NON-NLS-2$
+
+    initEClass(objectFilterEClass, ObjectFilter.class,
+        "ObjectFilter", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+
+    initEClass(expressionFilterEClass, ExpressionFilter.class,
+        "ExpressionFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEReference(
+        getExpressionFilter_Expression(),
+        theExpressionsPackage.getExpression(),
+        null,
+        "expression", null, 1, 1, ExpressionFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+
+    initEClass(combinedFilterEClass, CombinedFilter.class,
+        "CombinedFilter", IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+    initEReference(
+        getCombinedFilter_Operands(),
+        this.getPermissionFilter(),
+        null,
+        "operands", null, 1, -1, CombinedFilter.class, !IS_TRANSIENT, !IS_VOLATILE, IS_CHANGEABLE, IS_COMPOSITE, !IS_RESOLVE_PROXIES, !IS_UNSETTABLE, IS_UNIQUE, !IS_DERIVED, IS_ORDERED); //$NON-NLS-1$
+
+    initEClass(notFilterEClass, NotFilter.class, "NotFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+
+    initEClass(andFilterEClass, AndFilter.class, "AndFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+
+    initEClass(orFilterEClass, OrFilter.class, "OrFilter", !IS_ABSTRACT, !IS_INTERFACE, IS_GENERATED_INSTANCE_CLASS); //$NON-NLS-1$
+
     // Initialize enums and add enum literals
+    initEEnum(inclusionEEnum, Inclusion.class, "Inclusion"); //$NON-NLS-1$
+    addEEnumLiteral(inclusionEEnum, Inclusion.EXACT);
+    addEEnumLiteral(inclusionEEnum, Inclusion.EXACT_AND_UP);
+    addEEnumLiteral(inclusionEEnum, Inclusion.EXACT_AND_DOWN);
+    addEEnumLiteral(inclusionEEnum, Inclusion.REGEX);
+
     initEEnum(accessEEnum, Access.class, "Access"); //$NON-NLS-1$
     addEEnumLiteral(accessEEnum, Access.READ);
     addEEnumLiteral(accessEEnum, Access.WRITE);
@@ -1228,7 +1699,7 @@ public class SecurityPackageImpl extends EPackageImpl implements SecurityPackage
    */
   protected void createExtendedMetaDataAnnotations()
   {
-    String source = "http:///org/eclipse/emf/ecore/util/ExtendedMetaData"; //$NON-NLS-1$
+    String source = "http:///org/eclipse/emf/ecore/util/ExtendedMetaData"; //$NON-NLS-1$	
     addAnnotation(accessObjectEDataType, source, new String[] { "name", "Access:Object", //$NON-NLS-1$ //$NON-NLS-2$
         "baseType", "Access" //$NON-NLS-1$ //$NON-NLS-2$
     });
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java
index b3f52678c5..aab1336e13 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecurityAdapterFactory.java
@@ -11,14 +11,26 @@
 package org.eclipse.emf.cdo.security.util;
 
 import org.eclipse.emf.cdo.etypes.ModelElement;
+import org.eclipse.emf.cdo.security.AndFilter;
 import org.eclipse.emf.cdo.security.Assignee;
+import org.eclipse.emf.cdo.security.ClassFilter;
 import org.eclipse.emf.cdo.security.ClassPermission;
+import org.eclipse.emf.cdo.security.CombinedFilter;
 import org.eclipse.emf.cdo.security.Directory;
+import org.eclipse.emf.cdo.security.ExpressionFilter;
+import org.eclipse.emf.cdo.security.FilterPermission;
 import org.eclipse.emf.cdo.security.Group;
+import org.eclipse.emf.cdo.security.LinkedFilter;
+import org.eclipse.emf.cdo.security.NotFilter;
+import org.eclipse.emf.cdo.security.ObjectFilter;
 import org.eclipse.emf.cdo.security.ObjectPermission;
+import org.eclipse.emf.cdo.security.OrFilter;
+import org.eclipse.emf.cdo.security.PackageFilter;
 import org.eclipse.emf.cdo.security.PackagePermission;
 import org.eclipse.emf.cdo.security.Permission;
+import org.eclipse.emf.cdo.security.PermissionFilter;
 import org.eclipse.emf.cdo.security.Realm;
+import org.eclipse.emf.cdo.security.ResourceFilter;
 import org.eclipse.emf.cdo.security.ResourcePermission;
 import org.eclipse.emf.cdo.security.Role;
 import org.eclipse.emf.cdo.security.SecurityElement;
@@ -42,6 +54,7 @@ import org.eclipse.emf.ecore.EObject;
  * @see org.eclipse.emf.cdo.security.SecurityPackage
  * @generated
  */
+@SuppressWarnings("deprecation")
 public class SecurityAdapterFactory extends AdapterFactoryImpl
 {
   /**
@@ -181,6 +194,78 @@ public class SecurityAdapterFactory extends AdapterFactoryImpl
     }
 
     @Override
+    public Adapter caseFilterPermission(FilterPermission object)
+    {
+      return createFilterPermissionAdapter();
+    }
+
+    @Override
+    public Adapter casePermissionFilter(PermissionFilter object)
+    {
+      return createPermissionFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseLinkedFilter(LinkedFilter object)
+    {
+      return createLinkedFilterAdapter();
+    }
+
+    @Override
+    public Adapter casePackageFilter(PackageFilter object)
+    {
+      return createPackageFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseClassFilter(ClassFilter object)
+    {
+      return createClassFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseResourceFilter(ResourceFilter object)
+    {
+      return createResourceFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseObjectFilter(ObjectFilter object)
+    {
+      return createObjectFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseExpressionFilter(ExpressionFilter object)
+    {
+      return createExpressionFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseCombinedFilter(CombinedFilter object)
+    {
+      return createCombinedFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseNotFilter(NotFilter object)
+    {
+      return createNotFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseAndFilter(AndFilter object)
+    {
+      return createAndFilterAdapter();
+    }
+
+    @Override
+    public Adapter caseOrFilter(OrFilter object)
+    {
+      return createOrFilterAdapter();
+    }
+
+    @Override
     public Adapter caseModelElement(ModelElement object)
     {
       return createModelElementAdapter();
@@ -419,6 +504,198 @@ public class SecurityAdapterFactory extends AdapterFactoryImpl
   }
 
   /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.FilterPermission <em>Filter Permission</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.FilterPermission
+   * @generated
+   */
+  public Adapter createFilterPermissionAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.PermissionFilter <em>Permission Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.PermissionFilter
+   * @generated
+   */
+  public Adapter createPermissionFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.LinkedFilter <em>Linked Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.LinkedFilter
+   * @generated
+   */
+  public Adapter createLinkedFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.PackageFilter <em>Package Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.PackageFilter
+   * @generated
+   */
+  public Adapter createPackageFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.ClassFilter <em>Class Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.ClassFilter
+   * @generated
+   */
+  public Adapter createClassFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.ResourceFilter <em>Resource Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.ResourceFilter
+   * @generated
+   */
+  public Adapter createResourceFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.ObjectFilter <em>Object Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.ObjectFilter
+   * @generated
+   */
+  public Adapter createObjectFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.ExpressionFilter <em>Expression Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.ExpressionFilter
+   * @generated
+   */
+  public Adapter createExpressionFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.CombinedFilter <em>Combined Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.CombinedFilter
+   * @generated
+   */
+  public Adapter createCombinedFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.NotFilter <em>Not Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.NotFilter
+   * @generated
+   */
+  public Adapter createNotFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.AndFilter <em>And Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.AndFilter
+   * @generated
+   */
+  public Adapter createAndFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
+   * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.security.OrFilter <em>Or Filter</em>}'.
+   * <!-- begin-user-doc -->
+   * This default implementation returns null so that we can easily ignore cases;
+   * it's useful to ignore a case when inheritance will catch all the cases anyway.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @return the new adapter.
+   * @see org.eclipse.emf.cdo.security.OrFilter
+   * @generated
+   */
+  public Adapter createOrFilterAdapter()
+  {
+    return null;
+  }
+
+  /**
    * Creates a new adapter for an object of class '{@link org.eclipse.emf.cdo.etypes.ModelElement <em>Model Element</em>}'.
    * <!-- begin-user-doc -->
    * This default implementation returns null so that we can easily ignore cases;
diff --git a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java
index ea0140af35..225edf191e 100644
--- a/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java
+++ b/plugins/org.eclipse.emf.cdo.security/src/org/eclipse/emf/cdo/security/util/SecuritySwitch.java
@@ -11,14 +11,26 @@
 package org.eclipse.emf.cdo.security.util;
 
 import org.eclipse.emf.cdo.etypes.ModelElement;
+import org.eclipse.emf.cdo.security.AndFilter;
 import org.eclipse.emf.cdo.security.Assignee;
+import org.eclipse.emf.cdo.security.ClassFilter;
 import org.eclipse.emf.cdo.security.ClassPermission;
+import org.eclipse.emf.cdo.security.CombinedFilter;
 import org.eclipse.emf.cdo.security.Directory;
+import org.eclipse.emf.cdo.security.ExpressionFilter;
+import org.eclipse.emf.cdo.security.FilterPermission;
 import org.eclipse.emf.cdo.security.Group;
+import org.eclipse.emf.cdo.security.LinkedFilter;
+import org.eclipse.emf.cdo.security.NotFilter;
+import org.eclipse.emf.cdo.security.ObjectFilter;
 import org.eclipse.emf.cdo.security.ObjectPermission;
+import org.eclipse.emf.cdo.security.OrFilter;
+import org.eclipse.emf.cdo.security.PackageFilter;
 import org.eclipse.emf.cdo.security.PackagePermission;
 import org.eclipse.emf.cdo.security.Permission;
+import org.eclipse.emf.cdo.security.PermissionFilter;
 import org.eclipse.emf.cdo.security.Realm;
+import org.eclipse.emf.cdo.security.ResourceFilter;
 import org.eclipse.emf.cdo.security.ResourcePermission;
 import org.eclipse.emf.cdo.security.Role;
 import org.eclipse.emf.cdo.security.SecurityElement;
@@ -47,6 +59,7 @@ import java.util.List;
  * @see org.eclipse.emf.cdo.security.SecurityPackage
  * @generated
  */
+@SuppressWarnings("deprecation")
 public class SecuritySwitch<T>
 {
   /**
@@ -119,13 +132,9 @@ public class SecuritySwitch<T>
       SecurityElement securityElement = (SecurityElement)theEObject;
       T result = caseSecurityElement(securityElement);
       if (result == null)
-      {
         result = caseModelElement(securityElement);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.SECURITY_ITEM:
@@ -133,17 +142,11 @@ public class SecuritySwitch<T>
       SecurityItem securityItem = (SecurityItem)theEObject;
       T result = caseSecurityItem(securityItem);
       if (result == null)
-      {
         result = caseSecurityElement(securityItem);
-      }
       if (result == null)
-      {
         result = caseModelElement(securityItem);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.REALM:
@@ -151,17 +154,11 @@ public class SecuritySwitch<T>
       Realm realm = (Realm)theEObject;
       T result = caseRealm(realm);
       if (result == null)
-      {
         result = caseSecurityElement(realm);
-      }
       if (result == null)
-      {
         result = caseModelElement(realm);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.DIRECTORY:
@@ -169,21 +166,13 @@ public class SecuritySwitch<T>
       Directory directory = (Directory)theEObject;
       T result = caseDirectory(directory);
       if (result == null)
-      {
         result = caseSecurityItem(directory);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(directory);
-      }
       if (result == null)
-      {
         result = caseModelElement(directory);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.ROLE:
@@ -191,21 +180,13 @@ public class SecuritySwitch<T>
       Role role = (Role)theEObject;
       T result = caseRole(role);
       if (result == null)
-      {
         result = caseSecurityItem(role);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(role);
-      }
       if (result == null)
-      {
         result = caseModelElement(role);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.ASSIGNEE:
@@ -213,21 +194,13 @@ public class SecuritySwitch<T>
       Assignee assignee = (Assignee)theEObject;
       T result = caseAssignee(assignee);
       if (result == null)
-      {
         result = caseSecurityItem(assignee);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(assignee);
-      }
       if (result == null)
-      {
         result = caseModelElement(assignee);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.GROUP:
@@ -235,25 +208,15 @@ public class SecuritySwitch<T>
       Group group = (Group)theEObject;
       T result = caseGroup(group);
       if (result == null)
-      {
         result = caseAssignee(group);
-      }
       if (result == null)
-      {
         result = caseSecurityItem(group);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(group);
-      }
       if (result == null)
-      {
         result = caseModelElement(group);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.USER:
@@ -261,25 +224,15 @@ public class SecuritySwitch<T>
       User user = (User)theEObject;
       T result = caseUser(user);
       if (result == null)
-      {
         result = caseAssignee(user);
-      }
       if (result == null)
-      {
         result = caseSecurityItem(user);
-      }
       if (result == null)
-      {
         result = caseSecurityElement(user);
-      }
       if (result == null)
-      {
         result = caseModelElement(user);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.USER_PASSWORD:
@@ -287,9 +240,7 @@ public class SecuritySwitch<T>
       UserPassword userPassword = (UserPassword)theEObject;
       T result = caseUserPassword(userPassword);
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.PERMISSION:
@@ -297,9 +248,7 @@ public class SecuritySwitch<T>
       Permission permission = (Permission)theEObject;
       T result = casePermission(permission);
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.CLASS_PERMISSION:
@@ -307,13 +256,9 @@ public class SecuritySwitch<T>
       ClassPermission classPermission = (ClassPermission)theEObject;
       T result = caseClassPermission(classPermission);
       if (result == null)
-      {
         result = casePermission(classPermission);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.PACKAGE_PERMISSION:
@@ -321,13 +266,9 @@ public class SecuritySwitch<T>
       PackagePermission packagePermission = (PackagePermission)theEObject;
       T result = casePackagePermission(packagePermission);
       if (result == null)
-      {
         result = casePermission(packagePermission);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.RESOURCE_PERMISSION:
@@ -335,13 +276,9 @@ public class SecuritySwitch<T>
       ResourcePermission resourcePermission = (ResourcePermission)theEObject;
       T result = caseResourcePermission(resourcePermission);
       if (result == null)
-      {
         result = casePermission(resourcePermission);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
       return result;
     }
     case SecurityPackage.OBJECT_PERMISSION:
@@ -349,13 +286,135 @@ public class SecuritySwitch<T>
       ObjectPermission objectPermission = (ObjectPermission)theEObject;
       T result = caseObjectPermission(objectPermission);
       if (result == null)
-      {
         result = casePermission(objectPermission);
-      }
       if (result == null)
-      {
         result = defaultCase(theEObject);
-      }
+      return result;
+    }
+    case SecurityPackage.FILTER_PERMISSION:
+    {
+      FilterPermission filterPermission = (FilterPermission)theEObject;
+      T result = caseFilterPermission(filterPermission);
+      if (result == null)
+        result = casePermission(filterPermission);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.PERMISSION_FILTER:
+    {
+      PermissionFilter permissionFilter = (PermissionFilter)theEObject;
+      T result = casePermissionFilter(permissionFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.LINKED_FILTER:
+    {
+      LinkedFilter linkedFilter = (LinkedFilter)theEObject;
+      T result = caseLinkedFilter(linkedFilter);
+      if (result == null)
+        result = casePermissionFilter(linkedFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.PACKAGE_FILTER:
+    {
+      PackageFilter packageFilter = (PackageFilter)theEObject;
+      T result = casePackageFilter(packageFilter);
+      if (result == null)
+        result = casePermissionFilter(packageFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.CLASS_FILTER:
+    {
+      ClassFilter classFilter = (ClassFilter)theEObject;
+      T result = caseClassFilter(classFilter);
+      if (result == null)
+        result = casePermissionFilter(classFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.RESOURCE_FILTER:
+    {
+      ResourceFilter resourceFilter = (ResourceFilter)theEObject;
+      T result = caseResourceFilter(resourceFilter);
+      if (result == null)
+        result = casePermissionFilter(resourceFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.OBJECT_FILTER:
+    {
+      ObjectFilter objectFilter = (ObjectFilter)theEObject;
+      T result = caseObjectFilter(objectFilter);
+      if (result == null)
+        result = casePermissionFilter(objectFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.EXPRESSION_FILTER:
+    {
+      ExpressionFilter expressionFilter = (ExpressionFilter)theEObject;
+      T result = caseExpressionFilter(expressionFilter);
+      if (result == null)
+        result = caseObjectFilter(expressionFilter);
+      if (result == null)
+        result = casePermissionFilter(expressionFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.COMBINED_FILTER:
+    {
+      CombinedFilter combinedFilter = (CombinedFilter)theEObject;
+      T result = caseCombinedFilter(combinedFilter);
+      if (result == null)
+        result = casePermissionFilter(combinedFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.NOT_FILTER:
+    {
+      NotFilter notFilter = (NotFilter)theEObject;
+      T result = caseNotFilter(notFilter);
+      if (result == null)
+        result = caseCombinedFilter(notFilter);
+      if (result == null)
+        result = casePermissionFilter(notFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.AND_FILTER:
+    {
+      AndFilter andFilter = (AndFilter)theEObject;
+      T result = caseAndFilter(andFilter);
+      if (result == null)
+        result = caseCombinedFilter(andFilter);
+      if (result == null)
+        result = casePermissionFilter(andFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
+      return result;
+    }
+    case SecurityPackage.OR_FILTER:
+    {
+      OrFilter orFilter = (OrFilter)theEObject;
+      T result = caseOrFilter(orFilter);
+      if (result == null)
+        result = caseCombinedFilter(orFilter);
+      if (result == null)
+        result = casePermissionFilter(orFilter);
+      if (result == null)
+        result = defaultCase(theEObject);
       return result;
     }
     default:
@@ -589,6 +648,210 @@ public class SecuritySwitch<T>
   }
 
   /**
+   * Returns the result of interpreting the object as an instance of '<em>Filter Permission</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Filter Permission</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseFilterPermission(FilterPermission object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Permission Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Permission Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T casePermissionFilter(PermissionFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Linked Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Linked Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseLinkedFilter(LinkedFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Package Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Package Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T casePackageFilter(PackageFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Class Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Class Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseClassFilter(ClassFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Resource Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Resource Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseResourceFilter(ResourceFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Object Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Object Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseObjectFilter(ObjectFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Expression Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Expression Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseExpressionFilter(ExpressionFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Combined Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Combined Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseCombinedFilter(CombinedFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Not Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Not Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseNotFilter(NotFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>And Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>And Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseAndFilter(AndFilter object)
+  {
+    return null;
+  }
+
+  /**
+   * Returns the result of interpreting the object as an instance of '<em>Or Filter</em>'.
+   * <!-- begin-user-doc -->
+   * This implementation returns null;
+   * returning a non-null result will terminate the switch.
+   * @since 4.3
+   * <!-- end-user-doc -->
+   * @param object the target of the switch.
+   * @return the result of interpreting the object as an instance of '<em>Or Filter</em>'.
+   * @see #doSwitch(org.eclipse.emf.ecore.EObject) doSwitch(EObject)
+   * @generated
+   */
+  public T caseOrFilter(OrFilter object)
+  {
+    return null;
+  }
+
+  /**
    * Returns the result of interpreting the object as an instance of '<em>Model Element</em>'.
    * <!-- begin-user-doc -->
    * This implementation returns null;
diff --git a/plugins/org.eclipse.emf.cdo.server/CDOServer.launch b/plugins/org.eclipse.emf.cdo.server/CDOServer.launch
index d230b42983..04d32ada95 100644
--- a/plugins/org.eclipse.emf.cdo.server/CDOServer.launch
+++ b/plugins/org.eclipse.emf.cdo.server/CDOServer.launch
@@ -29,8 +29,8 @@
 <stringAttribute key="pde.version" value="3.3"/>
 <stringAttribute key="product" value="org.eclipse.platform.ide"/>
 <stringAttribute key="selectedPlugin" value="org.eclipse.emf.cdo"/>
-<stringAttribute key="selected_target_plugins" value="com.ibm.icu@default:default,com.mysql.jdbc@default:default,javax.xml@default:default,org.apache.derby@default:default,org.apache.felix.gogo.command@default:default,org.apache.felix.gogo.runtime@default:default,org.apache.felix.gogo.shell@default:default,org.eclipse.compare.core@default:default,org.eclipse.core.contenttype@default:default,org.eclipse.core.expressions@default:default,org.eclipse.core.filesystem.win32.x86_64@default:false,org.eclipse.core.filesystem@default:default,org.eclipse.core.jobs@default:default,org.eclipse.core.resources.win32.x86_64@default:false,org.eclipse.core.resources@default:default,org.eclipse.core.runtime.compatibility.registry@default:false,org.eclipse.core.runtime@default:true,org.eclipse.emf.common@default:default,org.eclipse.emf.ecore.change@default:default,org.eclipse.emf.ecore.xmi@default:default,org.eclipse.emf.ecore@default:default,org.eclipse.equinox.app@default:default,org.eclipse.equinox.common@2:true,org.eclipse.equinox.console@default:default,org.eclipse.equinox.preferences@default:default,org.eclipse.equinox.registry@default:default,org.eclipse.orbit.mongodb@default:default,org.eclipse.osgi@-1:true,org.eclipse.team.core@default:default,org.h2@default:default,org.hsqldb@default:default,org.postgresql@default:default"/>
-<stringAttribute key="selected_workspace_plugins" value="org.eclipse.emf.cdo.common@default:default,org.eclipse.emf.cdo.ecore.retrofit@default:false,org.eclipse.emf.cdo.examples.company@default:default,org.eclipse.emf.cdo.net4j@default:default,org.eclipse.emf.cdo.security@default:default,org.eclipse.emf.cdo.server.admin@default:default,org.eclipse.emf.cdo.server.db@default:default,org.eclipse.emf.cdo.server.mongodb@default:default,org.eclipse.emf.cdo.server.net4j@default:default,org.eclipse.emf.cdo.server.security@default:default,org.eclipse.emf.cdo.server@default:default,org.eclipse.emf.cdo@default:default,org.eclipse.net4j.db.derby@default:default,org.eclipse.net4j.db.h2@default:default,org.eclipse.net4j.db.hsqldb@default:default,org.eclipse.net4j.db.jdbc@default:default,org.eclipse.net4j.db.mysql@default:default,org.eclipse.net4j.db.postgresql@default:default,org.eclipse.net4j.db@default:default,org.eclipse.net4j.jvm@default:default,org.eclipse.net4j.tcp@default:default,org.eclipse.net4j.util@default:default,org.eclipse.net4j@default:default"/>
+<stringAttribute key="selected_target_plugins" value="com.ibm.icu@default:default,com.mysql.jdbc@default:default,javax.xml@default:default,org.apache.derby@default:default,org.apache.felix.gogo.command@default:default,org.apache.felix.gogo.runtime@default:default,org.apache.felix.gogo.shell@default:default,org.eclipse.ant.core@default:default,org.eclipse.compare.core@default:default,org.eclipse.core.contenttype@default:default,org.eclipse.core.expressions@default:default,org.eclipse.core.filesystem.win32.x86_64@default:false,org.eclipse.core.filesystem@default:default,org.eclipse.core.jobs@default:default,org.eclipse.core.resources.win32.x86_64@default:false,org.eclipse.core.resources@default:default,org.eclipse.core.runtime.compatibility.registry@default:false,org.eclipse.core.runtime@default:true,org.eclipse.core.variables@default:default,org.eclipse.emf.common@default:default,org.eclipse.emf.ecore.change@default:default,org.eclipse.emf.ecore.xmi@default:default,org.eclipse.emf.ecore@default:default,org.eclipse.equinox.app@default:default,org.eclipse.equinox.common@2:true,org.eclipse.equinox.console@default:default,org.eclipse.equinox.preferences@default:default,org.eclipse.equinox.registry@default:default,org.eclipse.orbit.mongodb@default:default,org.eclipse.osgi.compatibility.state@default:default,org.eclipse.osgi@-1:true,org.eclipse.team.core@default:default,org.h2@default:default,org.hsqldb@default:default,org.postgresql@default:default"/>
+<stringAttribute key="selected_workspace_plugins" value="org.eclipse.emf.cdo.common@default:default,org.eclipse.emf.cdo.ecore.retrofit@default:false,org.eclipse.emf.cdo.examples.company@default:default,org.eclipse.emf.cdo.expressions@default:default,org.eclipse.emf.cdo.net4j@default:default,org.eclipse.emf.cdo.security@default:default,org.eclipse.emf.cdo.server.admin@default:default,org.eclipse.emf.cdo.server.db@default:default,org.eclipse.emf.cdo.server.mongodb@default:default,org.eclipse.emf.cdo.server.net4j@default:default,org.eclipse.emf.cdo.server.security@default:default,org.eclipse.emf.cdo.server@default:default,org.eclipse.emf.cdo@default:default,org.eclipse.net4j.db.derby@default:default,org.eclipse.net4j.db.h2@default:default,org.eclipse.net4j.db.hsqldb@default:default,org.eclipse.net4j.db.jdbc@default:default,org.eclipse.net4j.db.mysql@default:default,org.eclipse.net4j.db.postgresql@default:default,org.eclipse.net4j.db@default:default,org.eclipse.net4j.jvm@default:default,org.eclipse.net4j.tcp@default:default,org.eclipse.net4j.util@default:default,org.eclipse.net4j@default:default"/>
 <booleanAttribute key="show_selected_only" value="false"/>
 <stringAttribute key="templateConfig" value="${target_home}\configuration\config.ini"/>
 <booleanAttribute key="tracing" value="false"/>