OK. I think my problem is that I'm too lazy to add "-r oacs-5-2" to my cvs checkouts. :P Anyway I was having a good run with the code in HEAD.
I had a go at trying to fix the code in the search package, but there was obviously code there that I did not know what to do with. Perhaps a service contract needs to be created to check the permissions/priveleges on the object before displaying it? Other packages can then implement that service contract to hide certain objects.
Cheers,
Nick.