Hi, I can use this to enable/disable attachments and comments on a per wiki basis: http://www.xwiki.org/xwiki/bin/view/FAQ/Howtodisablecommentsandattachments To the best of my understanding, there is no way of avoiding than an user that have access to a given document, access its attachments and comments provided he/she knows the right URL syntax. Is that correct? Thanks! Ricardo -- Ricardo Rodríguez CTO eBioTIC. Life Sciences, Data Modeling and Information Management Systems