Hi Jorg, I'm just trying a simple test for this using AEM6.1:Create a new group, which is a member of "Authors"using CRXDE, add the custom ACL deny write permission, with exception of *cq:annotations[img]repository permissions.png[/img]It doesn't seem to work - Was this what you were expecting?Also...