Index: test/edu/ucsb/nceas/metacattest/AccessAPITest.java
===================================================================
--- test/edu/ucsb/nceas/metacattest/AccessAPITest.java	(revision 6743)
+++ test/edu/ucsb/nceas/metacattest/AccessAPITest.java	(revision 6744)
@@ -137,7 +137,7 @@
 					true);
 			accessDAOList = new Vector<XMLAccessDAO>();
 			accessDAO = new XMLAccessDAO();
-			accessDAO.setDocId(docId);
+			accessDAO.setGuid(docId);
 			accessDAO.setPrincipalName(principal);
 			accessDAO.setPermission(new Long(AccessControlInterface.READ));
 			accessDAO.setPermType(AccessControlInterface.ALLOW);
@@ -470,7 +470,7 @@
                 
                 System.out.println("subAccessDAO.perm: '" + subAccessDAO.getPermission() + "'");
                 System.out.println("mainAccessDAO.perm: '" + mainAccessDAO.getPermission() + "'");*/
-				if (subAccessDAO.getDocId().equals(mainAccessDAO.getDocId()) &&
+				if (subAccessDAO.getGuid().equals(mainAccessDAO.getGuid()) &&
 						subAccessDAO.getPermOrder().equals(mainAccessDAO.getPermOrder()) &&
 						subAccessDAO.getPermType().equals(mainAccessDAO.getPermType()) &&
 						subAccessDAO.getPrincipalName().equals(mainAccessDAO.getPrincipalName()) &&
@@ -540,7 +540,7 @@
 	 */
 	private void debugAccessDAOList(Vector<XMLAccessDAO> accessDAOList) {
 		for (XMLAccessDAO xmlAccessDAO : accessDAOList) {
-			debug("Doc ID:      " + xmlAccessDAO.getDocId());
+			debug("Guid:      " + xmlAccessDAO.getGuid());
 			debug("Perm Order:  " + xmlAccessDAO.getPermOrder());
 			debug("Perm Type:   " + xmlAccessDAO.getPermType());
 			debug("Principal    " + xmlAccessDAO.getPrincipalName());
Index: src/upgrade-db-to-2.0.0-postgres.sql
===================================================================
--- src/upgrade-db-to-2.0.0-postgres.sql	(revision 6743)
+++ src/upgrade-db-to-2.0.0-postgres.sql	(revision 6744)
@@ -61,10 +61,6 @@
  * Replication changes to support DataONE System Metadata replication
  */
 ALTER TABLE xml_replication ADD COLUMN systemmetadatareplicate INT8;
-/*
- *  Allow guid in xml_access table (for system metadata)
-*/
-ALTER TABLE xml_access ADD COLUMN guid text;
 
 /**
  * track the user-agent for the request
@@ -76,6 +72,66 @@
  */
 INSERT INTO xml_catalog (entry_type, public_id, system_id)
   VALUES ('Schema', '@eml2_1_1namespace@', '/schema/eml-2.1.1/eml.xsd');  
+
+/**
+ * Generate GUIDs for docid.rev
+ */
+INSERT INTO identifier (docid, rev, guid) 
+	SELECT docid, rev, docid || '.' || rev FROM xml_documents;
+INSERT INTO identifier (docid, rev, guid)
+	SELECT docid, revisionid, docid || '.' || revisionid FROM xml_revisions;
+
+/**
+ *  Allow guid in xml_access table (for system metadata)
+ */
+ALTER TABLE xml_access ADD COLUMN guid text;
+
+/**
+ * Upgrade xml_access records to use GUID from identifier table
+ */
+INSERT INTO xml_access (
+	guid, principal_name, permission, perm_type, perm_order, 
+	docid, accessfileid, begin_time, end_time, ticket_count, subtreeid, startnodeid, endnodeid
+)
+	SELECT 
+		id.guid, xa.principal_name, xa.permission, xa.perm_type, xa.perm_order, 
+		xa.docid, xa.accessfileid, xa.begin_time, xa.end_time, xa.ticket_count, xa.subtreeid, xa.startnodeid, xa.endnodeid
+	FROM identifier id, xml_access xa
+	WHERE id.docid = xa.docid;
+
+/**
+ * Include inline access rows -- they have a special guid: 'scope.docid.rev.index'
+ */
+INSERT INTO xml_access (
+	guid, principal_name, permission, perm_type, perm_order, 
+	docid, accessfileid, begin_time, end_time, ticket_count, subtreeid, startnodeid, endnodeid
+)
+	SELECT 
+		docid, principal_name, permission, perm_type, perm_order, 
+		docid, accessfileid, begin_time, end_time, ticket_count, subtreeid, startnodeid, endnodeid
+	FROM xml_access
+	WHERE docid like '%.%.%.%';
+
+/**
+ * Update the accessfileid to use guid
+ * TODO: specific revision should be used
+ */
+UPDATE xml_access
+SET accessfileid = id.guid
+FROM identifier id, xml_access xa
+WHERE xa.accessfileid = id.docid
+
+
+/**
+ * Remove old access rules
+ */
+DELETE FROM xml_access WHERE guid is null;
+
+/**
+ * clean up the xml_access table
+ */
+ALTER TABLE xml_access DROP COLUMN docid;
+
 /*
  * update the database version
  */
Index: src/xmltables-postgres.sql
===================================================================
--- src/xmltables-postgres.sql	(revision 6743)
+++ src/xmltables-postgres.sql	(revision 6744)
@@ -209,7 +209,6 @@
  * ACL -- table to store ACL for XML documents by principals
  */
 CREATE TABLE xml_access (
-	docid VARCHAR(250),	-- the document id #
 	guid text,	-- foreign key to system metadata
 	accessfileid VARCHAR(250),	-- the document id # for the access file
 	principal_name VARCHAR(100),	-- name of user, group, etc.
Index: src/edu/ucsb/nceas/metacat/QuerySpecification.java
===================================================================
--- src/edu/ucsb/nceas/metacat/QuerySpecification.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/QuerySpecification.java	(revision 6744)
@@ -272,7 +272,7 @@
     {
         String allowQuery = null;
         String allowString = constructAllowString();
-        allowQuery = "SELECT docid from xml_access WHERE( " + allowString;
+        allowQuery = "SELECT id.docid from xml_access xa, identifier id WHERE id.guid = xa.guid AND ( " + allowString;
         allowQuery = allowQuery + ")";
         logMetacat.info("QuerySpecification.createAllowRuleQuery - allow query is: " + allowQuery);
         return allowQuery;
@@ -319,7 +319,7 @@
     {
         String denyQuery = null;
         String denyString = constructDenyString();
-        denyQuery = "SELECT docid from xml_access WHERE( " + denyString;
+        denyQuery = "SELECT id.docid from xml_access xa, identifier id WHERE id.guid = xa.guid AND ( " + denyString;
         denyQuery = denyQuery + ") ";
         logMetacat.info("QuerySpecification.createDenyRuleQuery - denyquery is: " + denyQuery);
         return denyQuery;
Index: src/edu/ucsb/nceas/metacat/spatial/SpatialHarvester.java
===================================================================
--- src/edu/ucsb/nceas/metacat/spatial/SpatialHarvester.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/spatial/SpatialHarvester.java	(revision 6744)
@@ -71,7 +71,7 @@
   }
 
   /**
-   * Returns a Vector of all the docids in the xml_path_index tables
+   * Returns a Vector of all the current versions of public docids
    */
   protected Vector<String> queryAllDocids() {
     Vector<String> _docs = new Vector<String>();
@@ -83,7 +83,13 @@
      * to be considered for the spatial cache
      */
     //String query = "select distinct docid from xml_path_index";
-    String query = "select distinct docid from xml_access where principal_name = 'public' and perm_type = 'allow'";
+    String query = "select distinct id.docid " +
+    		"from xml_access xa, identifier id, xml_documents xd " +
+    		"where xa.guid = id.guid " +
+    		"and id.docid = xd.docid " +
+    		"and id.rev = xd.rev " +
+    		"and xa.principal_name = 'public' " +
+    		"and xa.perm_type = 'allow'";
 
     try {
       pstmt = dbconn.prepareStatement(query);
Index: src/edu/ucsb/nceas/metacat/spatial/SpatialDocument.java
===================================================================
--- src/edu/ucsb/nceas/metacat/spatial/SpatialDocument.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/spatial/SpatialDocument.java	(revision 6744)
@@ -143,12 +143,18 @@
 		if (isSpatialDocument) {
 
 			/*
-			 * Get the bounding coordinates
+			 * Get the bounding coordinates for current public revision
 			 */
 			query = "SELECT path, nodedatanumerical, parentnodeid FROM xml_path_index"
 					+ " WHERE docid = ?"
-					+ " AND docid IN (SELECT distinct docid FROM xml_access WHERE docid = ?"
-					+ " AND principal_name = 'public' AND perm_type = 'allow')"
+					+ " AND docid IN " +
+							"(SELECT distinct id.docid " +
+							"FROM identifier id, xml_access xa, xml_documents xd "
+							+ " WHERE id.docid = ?"
+							+ " AND id.docid = xd.docid "
+							+ " AND id.rev = xd.rev "
+							+ " AND id.guid = xa.guid "
+							+ " AND xa.principal_name = 'public' AND xa.perm_type = 'allow')"
 					+ " AND (path = '" + westPath + "'" + "  OR path = '" + southPath
 					+ "'" + "  OR path = '" + eastPath + "'" + "  OR path = '"
 					+ northPath + "'" + " ) ORDER BY parentnodeid;";
Index: src/edu/ucsb/nceas/metacat/AssociateAccessPolicy.java
===================================================================
--- src/edu/ucsb/nceas/metacat/AssociateAccessPolicy.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/AssociateAccessPolicy.java	(revision 6744)
@@ -177,7 +177,7 @@
     ResultSet rs=null;
     
     //the query stirng
-    String query="SELECT docid from xml_access";
+    String query="SELECT id.docid from xml_access xa, identifier id where xa.guid = id.guid";
     try
     {
       pStmt=conn.prepareStatement(query);
@@ -409,8 +409,8 @@
             docId=(String)docList.nextElement();
             dataSetId=(String)docIdMapDataSetId.get(docId);
             query="select accessfileid, principal_name,permission,perm_type,"
-                +"perm_order,begin_time,end_time,ticket_count from xml_access "
-                +"where docid =?";
+                +"perm_order,begin_time,end_time,ticket_count from xml_access xa, identifier id "
+                +"where id.docid = ? and id.guid = xa.guid";
             pStmt=conn.prepareStatement(query);
             //bind the value to query
             pStmt.setString(1, dataSetId);
Index: src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessAccess.java
===================================================================
--- src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessAccess.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessAccess.java	(revision 6744)
@@ -35,11 +35,6 @@
 
 import org.apache.log4j.Logger;
 
-import edu.ucsb.nceas.metacat.AccessionNumber;
-import edu.ucsb.nceas.metacat.AccessionNumberException;
-import edu.ucsb.nceas.metacat.DBUtil;
-import edu.ucsb.nceas.metacat.IdentifierManager;
-import edu.ucsb.nceas.metacat.McdbDocNotFoundException;
 import edu.ucsb.nceas.metacat.database.DBConnection;
 import edu.ucsb.nceas.metacat.database.DBConnectionPool;
 import edu.ucsb.nceas.metacat.shared.AccessException;
@@ -48,21 +43,10 @@
 public class XMLAccessAccess extends BaseAccess {
 	
 	private Logger logMetacat = Logger.getLogger(XMLAccessAccess.class);
-	
-	private static String DOCID = "docid";
-	
-	private static String GUID = "guid";
-
-	private String idAttribute = DOCID;
-	
+			
 	// Constructor
 	public XMLAccessAccess() throws AccessException {}
 	
-	public XMLAccessAccess(boolean useGuid) {
-		if (useGuid) {
-			idAttribute = GUID;
-		}
-	}
 
 	/**
 	 * Get all xml access for a document
@@ -71,11 +55,11 @@
 	 *            the id of the document
 	 * @return an xml access DAO list
 	 */ 
-	public Vector<XMLAccessDAO> getXMLAccessForDoc(String id) throws AccessException {
+	public Vector<XMLAccessDAO> getXMLAccessForDoc(String guid) throws AccessException {
 
 		Vector<XMLAccessDAO> xmlAccessList = new Vector<XMLAccessDAO>();
 		
-		if (id == null) {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.getXMLAccessForDoc - doc id " + 
 					"must be specified when selecting xml_access record");
 		}
@@ -88,13 +72,13 @@
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.getXMLAccessForDoc");
     		serialNumber = conn.getCheckOutSerialNumber();
 
-			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ?";
+			String sql = "SELECT * FROM xml_access WHERE guid = ?";
 			pstmt = conn.prepareStatement(sql);
 
-			pstmt.setString(1, id);
+			pstmt.setString(1, guid);
 			
 			String sqlReport = "XMLAccessAccess.getXMLAccessForDoc - SQL: " + sql;
-			sqlReport += " [" + id + "]";
+			sqlReport += " [" + guid + "]";
 			
 			logMetacat.info(sqlReport);
 			
@@ -113,10 +97,10 @@
 			
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.getXMLAccessForDoc - SQL error when getting access " + 
-					" for id: " + id  + " : "  + sqle.getMessage());
+					" for id: " + guid  + " : "  + sqle.getMessage());
 		} catch (PermOrderException poe) {
 			String errorStr = "XMLAccessAccess.getXMLAccessForDoc - Permission order error when getting " + 
-				"access record for doc id: " + id + " : "  + poe.getMessage();
+				"access record for doc id: " + guid + " : "  + poe.getMessage();
 			logMetacat.error(errorStr);
 			throw new AccessException(errorStr);
 		} finally {
@@ -133,12 +117,12 @@
 	 *            the credentials of the principal in the database
 	 * @return an xml access DAO list
 	 */ 
-	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String id, String principalName) 
+	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String guid, String principalName) 
 			throws AccessException {
 
 		Vector<XMLAccessDAO> xmlAccessList = new Vector<XMLAccessDAO>();
 		
-		if (id == null) { 
+		if (guid == null) { 
 			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - doc id " + 
 					"must be specified when selecting xml_access record");
 		}
@@ -155,14 +139,14 @@
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.getXMLAccessForPrincipal");
     		serialNumber = conn.getCheckOutSerialNumber();
 			
-			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ?";
+			String sql = "SELECT * FROM xml_access WHERE guid = ? AND principal_name = ?";
 			pstmt = conn.prepareStatement(sql);
 
-			pstmt.setString(1, id);
+			pstmt.setString(1, guid);
 			pstmt.setString(2, principalName);
 			
 			String sqlReport = "XMLAccessAccess.getXMLAccessForPrincipal - SQL: " + sql;
-			sqlReport += " [" + id + "," + principalName + "]";
+			sqlReport += " [" + guid + "," + principalName + "]";
 			
 			logMetacat.info(sqlReport);
 			
@@ -181,10 +165,10 @@
 			
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - SQL error when getting access " + 
-					" for id: " + id + ", principal: " + principalName  + " : "  + sqle.getMessage());
+					" for id: " + guid + ", principal: " + principalName  + " : "  + sqle.getMessage());
 		} catch (PermOrderException poe) {
 			String errorStr = "XMLAccessAccess.getXMLAccessForPrincipal - Permission order error when getting " + 
-				"access record for id: " + id + ", principal: " + principalName + " : "  + poe.getMessage();
+				"access record for id: " + guid + ", principal: " + principalName + " : "  + poe.getMessage();
 			logMetacat.error(errorStr);
 			throw new AccessException(errorStr);
 		} finally {
@@ -195,18 +179,18 @@
 	/**
 	 * Get all xml access for a principal/permType/permOrder for a certain document
 	 * 
-	 * @param id
+	 * @param guid
 	 *            the id of the document
 	 * @param principalName
 	 *            the credentials of the principal in the database
 	 * @return an xml access DAO list
 	 */ 
-	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String id, String principalName, String permType, String permOrder) 
+	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String guid, String principalName, String permType, String permOrder) 
 			throws AccessException {
 
 		Vector<XMLAccessDAO> xmlAccessList = new Vector<XMLAccessDAO>();
 		
-		if (id == null) { 
+		if (guid == null) { 
 			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - doc id " + 
 					"must be specified when selecting xml_access record");
 		}
@@ -231,17 +215,17 @@
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.getXMLAccessForPrincipal");
     		serialNumber = conn.getCheckOutSerialNumber();
     		
-			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ? " + 
+			String sql = "SELECT * FROM xml_access WHERE guid = ? AND principal_name = ? " + 
 				"AND perm_type = ? AND perm_order = ?";
 			pstmt = conn.prepareStatement(sql);
 
-			pstmt.setString(1, id);
+			pstmt.setString(1, guid);
 			pstmt.setString(2, principalName);
 			pstmt.setString(3, permType);			
 			pstmt.setString(4, permOrder);
 			
 			String sqlReport = "XMLAccessAccess.getXMLAccessForPrincipal - SQL: " + sql;
-			sqlReport += " [" + id + "," + principalName + "," +  permType + "," + permOrder + "]";
+			sqlReport += " [" + guid + "," + principalName + "," +  permType + "," + permOrder + "]";
 			
 			logMetacat.info(sqlReport);
 			
@@ -259,10 +243,10 @@
 			
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - SQL error when getting access " + 
-					" for id: " + id + ", principal: " + principalName  + " : "  + sqle.getMessage());
+					" for id: " + guid + ", principal: " + principalName  + " : "  + sqle.getMessage());
 		} catch (PermOrderException poe) {
 			String errorStr = "XMLAccessAccess.getXMLAccessForPrincipal - Permission order error when getting " + 
-				"access record for id: " + id + ", principal: " + principalName + " : "  + poe.getMessage();
+				"access record for id: " + guid + ", principal: " + principalName + " : "  + poe.getMessage();
 			logMetacat.error(errorStr);
 			throw new AccessException(errorStr);
 		} finally {
@@ -275,7 +259,7 @@
 	 * principal already exists, bitwise OR the permission to the existing
 	 * permission and update.
 	 * 
-	 * @param id
+	 * @param guid
 	 *            document id
 	 * @param principalName
 	 *            principal credentials
@@ -286,30 +270,30 @@
 	 * @param permOrder
 	 *            permission order
 	 */
-	public void addXMLAccess(String id, String principalName, Long permission, String permType, 
+	public void addXMLAccess(String guid, String principalName, Long permission, String permType, 
 			String permOrder, String accessFileId, String subTreeId) throws AccessException, PermOrderException {
 		
-		permOrderConflict(id, permOrder);
+		permOrderConflict(guid, permOrder);
 		
 		Vector<XMLAccessDAO> xmlAccessList = 
-			getXMLAccessForPrincipal(id, principalName, permType, permOrder);
+			getXMLAccessForPrincipal(guid, principalName, permType, permOrder);
 		
 		// if more than one record exists for this principal on this document with the same
 		// access type / access order combination, call cleanup to combine common access and then
 		// re-retrieve the access list.
 		if (xmlAccessList.size() == 0) {
-			insertXMLAccess(id, principalName, permission, permType, permOrder, accessFileId, subTreeId);
+			insertXMLAccess(guid, principalName, permission, permType, permOrder, accessFileId, subTreeId);
 			return;
 		}
 		
 		if (xmlAccessList.size() > 1) {
 			cleanupXMLAccessForPrincipal(xmlAccessList);
-			xmlAccessList = getXMLAccessForPrincipal(id, principalName, permType, permOrder);
+			xmlAccessList = getXMLAccessForPrincipal(guid, principalName, permType, permOrder);
 		}
 		
 		if (xmlAccessList.size() == 0) {
 			throw new AccessException("XMLAccessAccess.addXMLAccess - xml access list is empty when " + 
-				"it shouldn't be for id: " + id + ", prinicpal name: " + principalName + ", perm type " + 
+				"it shouldn't be for id: " + guid + ", prinicpal name: " + principalName + ", perm type " + 
 				permType + ", perm order: " + permOrder);	
 		}
 		
@@ -319,7 +303,7 @@
 		//trying to add, update the access record with the existing permission bitwis OR-ed with our
 		// new permission
 		if ((xmlAccessDAO.getPermission() & permission) != permission) {		
-			updateXMLAccessPermission(id, principalName, xmlAccessDAO.getPermission() | permission);
+			updateXMLAccessPermission(guid, principalName, xmlAccessDAO.getPermission() | permission);
 		}
 	}
 	
@@ -332,14 +316,28 @@
 	 * @param xmlAccessList
 	 *            list of xml access dao objects that hold new access for the document
 	 */
-	public void replaceAccess(String id, List<XMLAccessDAO> xmlAccessList) throws AccessException {
-		deleteXMLAccessForDoc(id);
+	public void replaceAccess(String guid, List<XMLAccessDAO> xmlAccessList) throws AccessException {
+		deleteXMLAccessForDoc(guid);
 		
+		insertAccess(guid, xmlAccessList);
+	}
+	
+	/**
+	 * Set permissions for a given document. This means first removing all access control for the
+	 * document and then adding the given rules.
+	 * 
+	 * @param id
+	 *            document id
+	 * @param xmlAccessList
+	 *            list of xml access dao objects that hold new access for the document
+	 */
+	public void insertAccess(String guid, List<XMLAccessDAO> xmlAccessList) throws AccessException {
+		
 		// if more than one record exists for this principal on this document with the same
 		// access type / access order combination, call cleanup to combine common access and then
 		// re-retrieve the access list.
 		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
-			insertXMLAccess(id, xmlAccessDAO.getPrincipalName(), xmlAccessDAO.getPermission(), 
+			insertXMLAccess(guid, xmlAccessDAO.getPrincipalName(), xmlAccessDAO.getPermission(), 
 					xmlAccessDAO.getPermType(), xmlAccessDAO.getPermOrder(), xmlAccessDAO.getAccessFileId(), xmlAccessDAO.getSubTreeId());
 		}
 	}
@@ -360,7 +358,7 @@
 	 * @param permOrder
 	 *            permission order
 	 */
-	private void insertXMLAccess(String id, String principalName, Long permission, String permType,
+	private void insertXMLAccess(String guid, String principalName, Long permission, String permType,
 			String permOrder, String accessFileId, String subTreeId) throws AccessException {
 	    //System.out.println("permission in insertXMLAccess: " + permission);
 	    try
@@ -376,7 +374,7 @@
 	        logMetacat.warn(e.getMessage());
 	    }
 	    
-		if (id == null) {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.insertXMLAccess - id is required when " + 
 					"inserting XML access record");
 		}
@@ -405,50 +403,22 @@
 			serialNumber = conn.getCheckOutSerialNumber();
 			
 			String sql = "INSERT INTO xml_access " +
-				"(docid, guid, principal_name, permission, perm_type, perm_order, accessfileid, subtreeid ) " + 
-				"VALUES (?,?,?,?,?,?,?,?)";
+				"(guid, principal_name, permission, perm_type, perm_order, accessfileid, subtreeid ) " + 
+				"VALUES (?,?,?,?,?,?,?)";
 			pstmt = conn.prepareStatement(sql);
 
-			String guid = null;
-			String docid = null;
-			if (idAttribute.equals(GUID)) {
-				guid = id;
-				try {
-					String localId = IdentifierManager.getInstance().getLocalId(id);
-					// Parse the localId into scope and rev parts, strip off the rev
-		            AccessionNumber acc = new AccessionNumber(localId, "NOACTION");
-		            docid = acc.getDocid();
-				} catch (McdbDocNotFoundException e) {
-					//ignore
-					logMetacat.warn("No local id mapping found for guid: " + id);
-				} catch (NumberFormatException e) {
-                    logMetacat.warn("LocalId could not be parsed for guid: " + id);
-                } catch (AccessionNumberException e) {
-                    logMetacat.warn("LocalId could not be parsed for guid: " + id);
-                }
-			} else {
-				int rev = DBUtil.getLatestRevisionInDocumentTable(id);
-				try {
-					guid = IdentifierManager.getInstance().getGUID(id, rev);
-				} catch (McdbDocNotFoundException e) {
-					//ignore
-					logMetacat.warn("No guid mapping found for docid: " + id + "." + rev);
-				}
-				docid = id;
-			}
 			
 			// Bind the values to the query
-			pstmt.setString(1, docid);
-			pstmt.setString(2, guid);
-			pstmt.setString(3, principalName);
-			pstmt.setLong(4, permission);
-			pstmt.setString(5, permType);
-			pstmt.setString(6, permOrder);
-			pstmt.setString(7, accessFileId);
-			pstmt.setString(8, subTreeId);
+			pstmt.setString(1, guid);
+			pstmt.setString(2, principalName);
+			pstmt.setLong(3, permission);
+			pstmt.setString(4, permType);
+			pstmt.setString(5, permOrder);
+			pstmt.setString(6, accessFileId);
+			pstmt.setString(7, subTreeId);
 			
 			String sqlReport = "XMLAccessAccess.insertXMLAccess - SQL: " + sql;
-			sqlReport += " [" + docid + "," + guid + "," + principalName + "," +  permission + "," +  permType + "," + permOrder + "]";
+			sqlReport += " [" + guid + "," + principalName + "," +  permission + "," +  permType + "," + permOrder + "]";
 			
 			logMetacat.info(sqlReport);
 
@@ -455,7 +425,7 @@
 			pstmt.execute();
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.insertXMLAccess - SQL error when inserting"
-					+ "xml access permissions for id: " + id + ", principal: " + 
+					+ "xml access permissions for id: " + guid + ", principal: " + 
 					principalName + ":" + sqle.getMessage());
 		} finally {
 			closeDBObjects(pstmt, conn, serialNumber, logMetacat); 
@@ -466,7 +436,7 @@
 	 * Update existing xml access permissions in the db.  The permission value should be the combined
 	 * value of pre-existing permissions plus new permissions.
 	 * 
-	 * @param id
+	 * @param guid
 	 *            document id
 	 * @param principalName
 	 *            principal credentials
@@ -473,9 +443,9 @@
 	 * @param permission
 	 *            permission bitmap
 	 */
-	private void updateXMLAccessPermission(String id, String principalName, Long permission)
+	private void updateXMLAccessPermission(String guid, String principalName, Long permission)
 			throws AccessException {
-		if (id == null) {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.updateXMLAccessPermission - id is required when " + 
 					"updating XML access record");
 		}
@@ -497,16 +467,16 @@
 			serialNumber = conn.getCheckOutSerialNumber();
 			
 			String sql = "UPDATE xml_access SET permission = ?" +
-				"WHERE " + idAttribute + " = ? AND principal_name = ?";
+				"WHERE guid = ? AND principal_name = ?";
 			pstmt = conn.prepareStatement(sql);
 
 			// Bind the values to the query
 			pstmt.setLong(1, permission);
-			pstmt.setString(2, id);
+			pstmt.setString(2, guid);
 			pstmt.setString(3, principalName);
 			
 			String sqlReport = "XMLAccessAccess.updateXMLAccessPermission - SQL: " + sql;
-			sqlReport += " [" + permission + "," + id + "," + principalName + "]";
+			sqlReport += " [" + permission + "," + guid + "," + principalName + "]";
 			
 			logMetacat.info(sqlReport);
 
@@ -513,7 +483,7 @@
 			pstmt.execute();
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.updateXMLAccessPermission - SQL error when updating"
-					+ "xml access permissions for id: " + id + ", principal: " + 
+					+ "xml access permissions for id: " + guid + ", principal: " + 
 					principalName + ":" + sqle.getMessage());
 		} finally {
 			closeDBObjects(pstmt, conn, serialNumber, logMetacat); 
@@ -526,13 +496,13 @@
 	 * for a given document.  If the provided permission is exactly the same as what 
 	 * the principal has, the record is deleted from the database.
 	 * 
-	 * @param id
+	 * @param guid
 	 *            document id
 	 * @param principalName
 	 *            principal credentials
 	 */
-	public void removeXMLAccessForPrincipal(String id, String principalName, Long permission) throws AccessException {
-		if (id == null) {
+	public void removeXMLAccessForPrincipal(String guid, String principalName, Long permission) throws AccessException {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.removeXMLAccessForPrincipal - id is required when " + 
 					"removing XML access");
 		}
@@ -545,10 +515,10 @@
 					"updating XML access");
 		}
 		
-		Vector<XMLAccessDAO> xmlAccessList = getXMLAccessForPrincipal(id, principalName);
+		Vector<XMLAccessDAO> xmlAccessList = getXMLAccessForPrincipal(guid, principalName);
 		if (xmlAccessList.size() == 0) {
 			logMetacat.warn("XMLAccessAccess.removeXMLAccessForPrincipal - attempting to remove access when no " +
-				"access record exists for id: " + id + ", principal: " + principalName);
+				"access record exists for id: " + guid + ", principal: " + principalName);
 		} else {
 			long permissionMask = 0;
 			for (XMLAccessDAO xmlAccessDAO : xmlAccessList) {
@@ -559,13 +529,13 @@
 			// in this case, the only existing permissions are the ones we want to remove, so 
 			// delete the record(s) for this principal on this document
 			if ((permissionMask & permission) == permission) {
-				deleteXMLAccessForPrincipal(id, principalName);
+				deleteXMLAccessForPrincipal(guid, principalName);
 			}
 			
 			if (xmlAccessList.size() > 1) {
 				
 			} else {
-				updateXMLAccessPermission(id, principalName, permission);
+				updateXMLAccessPermission(guid, principalName, permission);
 			}
 		}
 	   
@@ -577,8 +547,8 @@
 	 * @param id
 	 *            document id
 	 */
-	public void deleteXMLAccessForDoc(String id) throws AccessException {
-		if (id == null) {
+	public void deleteXMLAccessForDoc(String guid) throws AccessException {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - id is required when " + 
 					"deleting XML access record");
 		}
@@ -588,48 +558,18 @@
 		int serialNumber = -1;
 		try {
 			
-			String guid = null;
-			String docid = null;
-			if (idAttribute.equals(GUID)) {
-				guid = id;
-				try {
-					String localId = IdentifierManager.getInstance().getLocalId(id);
-					// Parse the localId into scope and rev parts, strip off the rev
-		            AccessionNumber acc = new AccessionNumber(localId, "NOACTION");
-		            docid = acc.getDocid();
-				} catch (McdbDocNotFoundException e) {
-					//ignore
-					logMetacat.warn("No local id mapping found for guid: " + id);
-				} catch (NumberFormatException e) {
-                    logMetacat.warn("LocalId could not be parsed for guid: " + id);
-                } catch (AccessionNumberException e) {
-                    logMetacat.warn("LocalId could not be parsed for guid: " + id);
-                }
-			} else {
-				int rev = DBUtil.getLatestRevisionInDocumentTable(id);
-				try {
-					guid = IdentifierManager.getInstance().getGUID(id, rev);
-				} catch (McdbDocNotFoundException e) {
-					//ignore
-					logMetacat.warn("No guid mapping found for docid: " + id + "." + rev);
-				}
-				docid = id;
-			}
-			
 			// check out DBConnection
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForDoc");
     		serialNumber = conn.getCheckOutSerialNumber();
     		
-			String sql = "DELETE FROM xml_access WHERE docid = ? OR guid = ?";
+			String sql = "DELETE FROM xml_access WHERE guid = ?";
 			pstmt = conn.prepareStatement(sql);
 
 			// Bind the values to the query
-			pstmt.setString(1, docid);
-			pstmt.setString(2, guid);
+			pstmt.setString(1, guid);
 
-
 			String sqlReport = "XMLAccessAccess.deleteXMLAccessForDoc - SQL: " + sql;
-			sqlReport += " [" + id + "]";
+			sqlReport += " [" + guid + "]";
 			
 			logMetacat.info(sqlReport);
 
@@ -636,7 +576,7 @@
 			pstmt.execute();
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - SQL error when deleting"
-					+ "xml access permissions for id: " + id + ":" + sqle.getMessage());
+					+ "xml access permissions for id: " + guid + ":" + sqle.getMessage());
 		} finally {
 			closeDBObjects(pstmt, conn, serialNumber, logMetacat); 
 		}	   
@@ -646,13 +586,13 @@
 	 * Delete xml access.  This removes all access records from the database for a principal 
 	 * for a given document
 	 * 
-	 * @param id
+	 * @param guid
 	 *            document id
 	 * @param principal
 	 *            principal credentials
 	 */
-	private void deleteXMLAccessForPrincipal(String id, String principalName) throws AccessException {
-		if (id == null) {
+	private void deleteXMLAccessForPrincipal(String guid, String principalName) throws AccessException {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - id is required when " + 
 					"deleting XML access record");
 		}
@@ -669,15 +609,15 @@
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForPrincipal");
     		serialNumber = conn.getCheckOutSerialNumber();
     		
-			String sql = "DELETE FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ?";
+			String sql = "DELETE FROM xml_access WHERE guid = ? AND principal_name = ?";
 			pstmt = conn.prepareStatement(sql);
 
 			// Bind the values to the query
-			pstmt.setString(1, id);
+			pstmt.setString(1, guid);
 			pstmt.setString(2, principalName);
 
 			String sqlReport = "XMLAccessAccess.deleteXMLAccessForPrincipal - SQL: " + sql;
-			sqlReport += " [" + id + "," + principalName + "]";
+			sqlReport += " [" + guid + "," + principalName + "]";
 			
 			logMetacat.info(sqlReport);
 
@@ -684,7 +624,7 @@
 			pstmt.execute();
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - SQL error when deleting"
-					+ "xml access permissions for id: " + id + ", principal: " + 
+					+ "xml access permissions for id: " + guid + ", principal: " + 
 					principalName + ":" + sqle.getMessage());
 		} finally {
 			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
@@ -692,16 +632,65 @@
 	}
 	
 	/**
+	 * Delete xml access.  This removes all access records from the database for a principal 
+	 * for a given document
+	 * 
+	 * @param guid
+	 *            document id
+	 * @param principal
+	 *            principal credentials
+	 */
+	public void deleteXMLAccessForDoc(String guid, String permType) throws AccessException {
+		if (guid == null) {
+			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - id is required when " + 
+					"deleting XML access record");
+		}
+		if (permType == null) {
+			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - permType is required when " + 
+					"deleting XML access record");
+		}
+		
+	    PreparedStatement pstmt = null;
+		DBConnection conn = null;
+		int serialNumber = -1;
+		try {
+			// check out DBConnection
+			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForDoc");
+    		serialNumber = conn.getCheckOutSerialNumber();
+    		
+			String sql = "DELETE FROM xml_access WHERE guid = ? AND perm_type = ?";
+			pstmt = conn.prepareStatement(sql);
+
+			// Bind the values to the query
+			pstmt.setString(1, guid);
+			pstmt.setString(2, permType);
+
+			String sqlReport = "XMLAccessAccess.deleteXMLAccessForDoc - SQL: " + sql;
+			sqlReport += " [" + guid + "," + permType + "]";
+			
+			logMetacat.info(sqlReport);
+
+			pstmt.execute();
+		} catch (SQLException sqle) {
+			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - SQL error when deleting"
+					+ "xml access permissions for id: " + guid + ", permType: " + 
+					permType + ":" + sqle.getMessage());
+		} finally {
+			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
+		}	   
+	}
+	
+	/**
 	 * Checks to see if there is a permission order conflict for a given document.  Each 
 	 * document is only allowed to have a single permission order
 	 * 
-	 * @param id
+	 * @param guid
 	 *            document id
 	 * @param principal
 	 *            principal credentials
 	 */
-	private void permOrderConflict(String id, String permOrder) throws AccessException, PermOrderException {
-		if (id == null) {
+	private void permOrderConflict(String guid, String permOrder) throws AccessException, PermOrderException {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.permOrderConflict - id is required when " + 
 					"determining perm order conflict");
 		}
@@ -718,15 +707,15 @@
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.permOrderConflict");
     		serialNumber = conn.getCheckOutSerialNumber();
     		
-			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ? AND perm_order != ?";
+			String sql = "SELECT * FROM xml_access WHERE guid = ? AND perm_order != ?";
 			pstmt = conn.prepareStatement(sql);
 
 			// Bind the values to the query
-			pstmt.setString(1, id);
+			pstmt.setString(1, guid);
 			pstmt.setString(2, permOrder);
 			
 			String sqlReport = "XMLAccessAccess.permOrderConflict - SQL: " + sql;
-			sqlReport += " [" + id + "," + permOrder + "]";
+			sqlReport += " [" + guid + "," + permOrder + "]";
 			
 			logMetacat.info(sqlReport);
 
@@ -735,11 +724,11 @@
 			ResultSet resultSet = pstmt.getResultSet();
 			if (resultSet.next()) {			
 				throw new PermOrderException("XMLAccessAccess.addXMLAccess - cannot add permission " + 
-					"record for id: " + id + "with permOrder: " + permOrder + " due to permOrder conflict");
+					"record for id: " + guid + "with permOrder: " + permOrder + " due to permOrder conflict");
 			}
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.permOrderConflict - SQL error when checking"
-					+ "for perm order conflict on: " + id + ":" + sqle.getMessage());
+					+ "for perm order conflict on: " + guid + ":" + sqle.getMessage());
 		} finally {
 			closeDBObjects(pstmt, conn, serialNumber, logMetacat); 
 		}
@@ -750,13 +739,13 @@
 	 * Delete xml access.  This removes all access records from the database for a principal 
 	 * for a given document, perm type and perm order
 	 * 
-	 * @param id
+	 * @param guid
 	 *            document id
 	 * @param principal
 	 *            principal credentials
 	 */
-	private void deleteXMLAccessForPrincipal(String id, String principalName, String permType, String permOrder) throws AccessException {
-		if (id == null) {
+	private void deleteXMLAccessForPrincipal(String guid, String principalName, String permType, String permOrder) throws AccessException {
+		if (guid == null) {
 			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - id is required when " + 
 					"deleting XML access record");
 		}
@@ -783,18 +772,18 @@
 			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForPrincipal");
     		serialNumber = conn.getCheckOutSerialNumber();
     		
-			String sql = "DELETE FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ? " +
+			String sql = "DELETE FROM xml_access WHERE guid = ? AND principal_name = ? " +
 				"AND perm_type = ? AND perm_order = ?";
 			pstmt = conn.prepareStatement(sql);
 
 			// Bind the values to the query
-			pstmt.setString(1, id);
+			pstmt.setString(1, guid);
 			pstmt.setString(2, principalName);
 			pstmt.setString(3, permType);
 			pstmt.setString(4, permOrder);
 			
 			String sqlReport = "XMLAccessAccess.deleteXMLAccessForPrincipal - SQL: " + sql;
-			sqlReport += " [" + id + "," + principalName + "," + permType + "," + permOrder + "]";
+			sqlReport += " [" + guid + "," + principalName + "," + permType + "," + permOrder + "]";
 			
 			logMetacat.info(sqlReport);
 
@@ -801,7 +790,7 @@
 			pstmt.execute();
 		} catch (SQLException sqle) {
 			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - SQL error when deleting"
-					+ "xml access permissions for id: " + id + ", principal: " + 
+					+ "xml access permissions for id: " + guid + ", principal: " + 
 					principalName + ":" + sqle.getMessage());
 		} finally {
 			closeDBObjects(pstmt, conn, serialNumber, logMetacat); 
@@ -822,7 +811,7 @@
 		int numDenyRecords = 0;
 		long allowPermissionMask = 0;
 		long denyPermissionMask = 0;
-		String id = null;
+		String guid = null;
 		String principalName = null;
 		String permType = null;
 		String permOrder = null;
@@ -834,16 +823,13 @@
 		// iterate through the list of access dao objects and bttwise or the permissions.  Most
 		// of this is just doing some error checking to make sure each record is valid.
 		for (XMLAccessDAO xmlAccessDAO : xmlAccessList) {
-			String daoId = xmlAccessDAO.getDocId();
-			if (idAttribute.equals(GUID)) {
-				daoId = xmlAccessDAO.getGuid();
-			}
-			if (id == null) {
-				id = daoId;
+			String daoId = xmlAccessDAO.getGuid();
+			if (guid == null) {
+				guid = daoId;
 			} else {
-				if (!id.equals(daoId)) {
+				if (!guid.equals(daoId)) {
 					throw new AccessException("XMLAccessAccess.cleanupXMLAccessForPrincipal - " + 
-							" Conflicting ids " + daoId + " and " + id);
+							" Conflicting ids " + daoId + " and " + guid);
 				}
 			}
 			if (principalName == null) {
@@ -900,14 +886,14 @@
 		// if there was more than one allow record, remove all allow records for this user on this doc 
 		// with this perm type and perm order then insert a single record 
 		if (numAllowRecords > 1) {
-			deleteXMLAccessForPrincipal(id, principalName, AccessControlInterface.ALLOW, permOrder);
-			insertXMLAccess(id, principalName, allowPermissionMask, AccessControlInterface.ALLOW, permOrder, accessFileId, subTreeId);
+			deleteXMLAccessForPrincipal(guid, principalName, AccessControlInterface.ALLOW, permOrder);
+			insertXMLAccess(guid, principalName, allowPermissionMask, AccessControlInterface.ALLOW, permOrder, accessFileId, subTreeId);
 		}
 		// if there was more than one deny record, remove all deny records for this user on this doc 
 		// with this perm type and perm order then insert a single record 
 		if (numDenyRecords > 1) {
-			deleteXMLAccessForPrincipal(id, principalName, AccessControlInterface.DENY, permOrder);
-			insertXMLAccess(id, principalName, denyPermissionMask, AccessControlInterface.DENY, permOrder, accessFileId, subTreeId);
+			deleteXMLAccessForPrincipal(guid, principalName, AccessControlInterface.DENY, permOrder);
+			insertXMLAccess(guid, principalName, denyPermissionMask, AccessControlInterface.DENY, permOrder, accessFileId, subTreeId);
 		}
 	}
 	
@@ -921,10 +907,7 @@
 	private void validateDocXMLAccessList(Vector<XMLAccessDAO> xmlAccessList) throws PermOrderException {
 		String permOrder = null;
 		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
-			String daoId = xmlAccessDAO.getDocId();
-			if (idAttribute.equals(GUID)) {
-				daoId = xmlAccessDAO.getGuid();
-			}
+			String daoId = xmlAccessDAO.getGuid();
 			if (permOrder == null) {
 				permOrder = xmlAccessDAO.getPermOrder();
 			} else {
@@ -949,7 +932,7 @@
 		
 		boolean allowFirst = false;
 		boolean denyFirst = false;
-		String id = null;
+		String guid = null;
 		
 		// These vectors will hold all combinations of access DAOs with different permission
 		// orders and permission types.  
@@ -960,13 +943,10 @@
 		
 		// sort the access dao records into the appropriate vector
 		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
-			String daoId = xmlAccessDAO.getDocId();
-			if (idAttribute.equals(GUID)) {
-				daoId = xmlAccessDAO.getGuid();
+			String daoId = xmlAccessDAO.getGuid();
+			if (guid == null) {
+				guid = daoId;
 			}
-			if (id == null) {
-				id = daoId;
-			}
 			if (xmlAccessDAO.getPermOrder().equals(AccessControlInterface.ALLOWFIRST)) {
 				allowFirst = true;
 				if (xmlAccessDAO.getPermType().equals(AccessControlInterface.ALLOW)) {
@@ -1000,7 +980,7 @@
 		// document
 		if(allowFirst && denyFirst) {
 			throw new PermOrderException("XMLAccessAccess.validatePrincipalXMLAccessList - " + 
-					" Conflicting permission orders for document " + id +
+					" Conflicting permission orders for document " + guid +
 					". Database intervention required ");
 		}	
 	}
@@ -1015,7 +995,7 @@
 	protected XMLAccessDAO populateDAO(ResultSet resultSet) throws SQLException {
 
 		XMLAccessDAO xmlAccessDAO = new XMLAccessDAO();
-		xmlAccessDAO.setDocId(resultSet.getString(idAttribute));
+		xmlAccessDAO.setGuid(resultSet.getString("guid"));
 		xmlAccessDAO.setAccessFileId(resultSet.getString("accessfileid"));
 		xmlAccessDAO.setPrincipalName(resultSet.getString("principal_name"));
 		xmlAccessDAO.setPermission(resultSet.getLong("permission"));
Index: src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessDAO.java
===================================================================
--- src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessDAO.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessDAO.java	(revision 6744)
@@ -39,7 +39,6 @@
  */
 public class XMLAccessDAO extends BaseDAO {
 
-	private String _docId = null;
 	private String _guid = null;
 	private String _accessFileId = null;
 	private String _principalName = null;
@@ -52,19 +51,7 @@
 	private String _subTreeId = null;
 	private String _startNodeId = null;
 	private String _endNodeId = null;
-
-	public String getDocId() {
-		return _docId;
-	}
 	
-	public void setDocId(String docId) {
-		if (docId != null && docId.equals("")) {
-			docId = null;
-		} else {
-			_docId = docId;
-		}
-	}
-	
 	public String getGuid() {
 		return _guid;
 	}
Index: src/edu/ucsb/nceas/metacat/accesscontrol/AccessControlForSingleFile.java
===================================================================
--- src/edu/ucsb/nceas/metacat/accesscontrol/AccessControlForSingleFile.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/accesscontrol/AccessControlForSingleFile.java	(revision 6744)
@@ -42,7 +42,10 @@
 import org.xml.sax.XMLReader;
 import org.xml.sax.helpers.XMLReaderFactory;
 
+import edu.ucsb.nceas.metacat.DBUtil;
 import edu.ucsb.nceas.metacat.DocInfoHandler;
+import edu.ucsb.nceas.metacat.IdentifierManager;
+import edu.ucsb.nceas.metacat.McdbDocNotFoundException;
 import edu.ucsb.nceas.metacat.McdbException;
 import edu.ucsb.nceas.metacat.PermissionController;
 import edu.ucsb.nceas.metacat.database.DBConnection;
@@ -61,9 +64,9 @@
 public class AccessControlForSingleFile implements AccessControlInterface 
 {
 
-  private String _docId;
+  private String _guid;
+  
   private Logger logMetacat = Logger.getLogger(AccessControlForSingleFile.class);
-
  
     /**
 	 * Construct an instance of the AccessControlForSingleFile class.  This
@@ -75,14 +78,50 @@
 	public AccessControlForSingleFile(String accessionNumber)
 			throws AccessControlException {
 
-		// Get rid of dev if myaccessNumber has one;
-		_docId = DocumentUtil.getDocIdFromString(accessionNumber);
-		if (_docId == null || _docId.equals("")) {
-			throw new AccessControlException("AccessControlForSingleFile() - Accession number "
-							+ "can't be null in constructor");
+		// this is a local metacat id
+		String docid = DocumentUtil.getDocIdFromString(accessionNumber);
+		// get the revision
+		String revision = DocumentUtil.getRevisionStringFromString(accessionNumber);
+		int rev = -1;
+		if (revision != null) {
+			// we were given it
+			rev = Integer.valueOf(revision);
+		} else {
+			// look up the latest
+			try {
+				rev = DBUtil.getLatestRevisionInDocumentTable(docid);
+			} catch (SQLException e) {
+				AccessControlException ace = new AccessControlException(e.getMessage());
+				ace.initCause(e);
+				throw ace;
+			}
+			if (rev <= 0) {
+				// look in the revisions table
+				try {
+					rev = DBUtil.getMaxRevFromRevisionTable(docid);
+				} catch (SQLException e) {
+					AccessControlException ace = new AccessControlException(e.getMessage());
+					ace.initCause(e);
+					throw ace;
+				}
+			}
 		}
+		
+		// find the guid for this docid.rev
+		try {
+			_guid = IdentifierManager.getInstance().getGUID(docid, rev);
+		} catch (McdbDocNotFoundException e) {
+			AccessControlException ace = new AccessControlException(e.getMessage());
+			ace.initCause(e);
+			throw ace;
+		}
+		
+		// couldn't find it?
+		if (_guid == null || _guid.equals("")) {
+			throw new AccessControlException("Guid cannot be null");
+		}
 
-		logMetacat.debug("AccessControlForSingleFile() - docid: " + _docId);
+		logMetacat.debug("AccessControlForSingleFile() - docid: " + _guid);
 	}
   
   	/**
@@ -118,7 +157,7 @@
 			// doc id.
 			XMLAccessAccess xmlAccessAccess = new XMLAccessAccess();
 			//System.out.println("permission in accessControlForSingleFile.insertPermissions: " + permission);
-			xmlAccessAccess.addXMLAccess(_docId, principalName, new Long(permission), permType, permOrder, accessFileId, subTreeId);
+			xmlAccessAccess.addXMLAccess(_guid, principalName, new Long(permission), permType, permOrder, accessFileId, subTreeId);
 		} catch (AccessException ae) {
 			throw new AccessControlException("AccessControlForSingleFile.insertPermissions - "
 					+ "DB access error when inserting permissions: " + ae.getMessage());
@@ -137,7 +176,7 @@
 		try {	
 			// use DocInfoHandler to parse the access section into DAO objects
 			XMLReader parser = null;
-			DocInfoHandler docInfoHandler = new DocInfoHandler(_docId); 
+			DocInfoHandler docInfoHandler = new DocInfoHandler(_guid); 
 			ContentHandler chandler = docInfoHandler;
 
 			// Get an instance of the parser
@@ -155,7 +194,7 @@
 				
 			// replace all access on the document
 	        Vector<XMLAccessDAO> accessControlList = docInfoHandler.getAccessControlList();
-	        xmlAccessAccess.replaceAccess(_docId, accessControlList);
+	        xmlAccessAccess.replaceAccess(_guid, accessControlList);
 
 		} catch (PropertyNotFoundException pnfe) {
 			throw new AccessControlException("AccessControlForSingleFile.insertPermissions - "
@@ -199,7 +238,7 @@
 				"AND perm_order = ? ");
      
 			// Bind the values to the query
-			pstmt.setString(1, _docId);
+			pstmt.setString(1, _guid);
 			pstmt.setString(2, xmlAccessDAO.getPrincipalName());
 			pstmt.setLong(3, xmlAccessDAO.getPermission());
 			pstmt.setString(4, xmlAccessDAO.getPermType());
@@ -246,7 +285,7 @@
 		try {   
 			hasPermission = isOwned(user);
 			if (!hasPermission) {
-				PermissionController controller = new PermissionController(_docId);
+				PermissionController controller = new PermissionController(_guid);
 				hasPermission = 
 					controller.hasPermission(user, groups, READSTRING);
 			}
@@ -257,7 +296,7 @@
 			if (hasPermission) {
 				// Get a list of all access dao objects for this docid
 				XMLAccessAccess xmlAccessAccess = new XMLAccessAccess();
-				Vector<XMLAccessDAO> xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_docId);
+				Vector<XMLAccessDAO> xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_guid);
 				output.append(getAccessString(xmlAccessDAOList));
 			} else {
 				output.append(getAccessString(new Vector<XMLAccessDAO>()));
@@ -288,7 +327,7 @@
 		try {
 			// Get a list of all access dao objects for this docid
 			XMLAccessAccess xmlAccessAccess = new XMLAccessAccess();
-			xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_docId);
+			xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_guid);
 		} catch (AccessException ae) {
 				throw new AccessControlException("AccessControlForSingleFile.getAccessString() - DB access error when " + 
 						"getting access string: " + ae.getMessage());
@@ -324,7 +363,7 @@
 			subtreeid = xmlAccessDAOList.get(0).getSubTreeId();
 		}
 
-		output.append("<access authSystem=\"knb\" order=\"" + permOrder + "\" id=\"" + _docId + "\" scope=\"document\"");
+		output.append("<access authSystem=\"knb\" order=\"" + permOrder + "\" id=\"" + _guid + "\" scope=\"document\"");
 		if (accessfileid != null) {
 			output.append(" accessfileid=\"" + accessfileid + "\"");
 		}
@@ -398,7 +437,7 @@
 			serialNumber = conn.getCheckOutSerialNumber();
 			pstmt = conn.prepareStatement("SELECT 'x' FROM xml_documents "
 					+ "WHERE docid = ? " + "AND user_owner = ?");
-			pstmt.setString(1, _docId);
+			pstmt.setString(1, _guid);
 			pstmt.setString(2, user);
 			pstmt.execute();
 			ResultSet rs = pstmt.getResultSet();
Index: src/edu/ucsb/nceas/metacat/clientview/ClientViewHelper.java
===================================================================
--- src/edu/ucsb/nceas/metacat/clientview/ClientViewHelper.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/clientview/ClientViewHelper.java	(revision 6744)
@@ -15,6 +15,8 @@
 import com.oreilly.servlet.multipart.Part;
 
 import edu.ucsb.nceas.metacat.DocInfoHandler;
+import edu.ucsb.nceas.metacat.IdentifierManager;
+import edu.ucsb.nceas.metacat.McdbDocNotFoundException;
 import edu.ucsb.nceas.metacat.accesscontrol.AccessControlException;
 import edu.ucsb.nceas.metacat.accesscontrol.AccessControlForSingleFile;
 import edu.ucsb.nceas.metacat.accesscontrol.AccessControlInterface;
@@ -505,7 +507,7 @@
     }
     
     private String setPublicAccess(String permissionType, String metaDocId, Stack docIdStack)
-    throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException{
+    throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException, McdbDocNotFoundException{
         String                      result = " for Documents ";
         String                      docId, lst = metaDocId, permOrder;
         
@@ -534,7 +536,7 @@
      * Second, remove all access rules of the user public, then add the new rules. 
      */
     private void setPublicReadAccess(String permissionType, String docid) 
-        throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException{
+        throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException, McdbDocNotFoundException{
       String originalAccessBlock = getMetacatClient().getAccessControl(docid);
       Vector<XMLAccessDAO> accessList = parseAccessXMLBlock(docid, originalAccessBlock);
       if(accessList != null  && !accessList.isEmpty()) {
@@ -607,10 +609,12 @@
      * Populate xmlAccessDAO object with the some parameters.
      */
     private XMLAccessDAO generateXMLAccessDAO(String docid, String principalName,
-        String permission, String permType, String permOrder) {
-      String identifier = DocumentUtil.getDocIdFromString(docid);
+        String permission, String permType, String permOrder) throws McdbDocNotFoundException {
+      String localId = DocumentUtil.getDocIdFromString(docid);
+      int rev = DocumentUtil.getRevisionFromAccessionNumber(docid);
+      String identifier = IdentifierManager.getInstance().getGUID(localId, rev);
       XMLAccessDAO xmlAccessDAO = new XMLAccessDAO();
-      xmlAccessDAO.setDocId(identifier);
+      xmlAccessDAO.setGuid(identifier);
       xmlAccessDAO.setPrincipalName(principalName);
       xmlAccessDAO.setPermission(Integer.valueOf(AccessControlList.intValue(permission)).longValue());
       xmlAccessDAO.setPermType(permType);
Index: src/edu/ucsb/nceas/metacat/PermissionController.java
===================================================================
--- src/edu/ucsb/nceas/metacat/PermissionController.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/PermissionController.java	(revision 6744)
@@ -53,7 +53,11 @@
 
 public class PermissionController
 {
-   private String docId = null;
+//   private String docId = null;
+//   private int rev = -1;
+   
+   private String guid = null;
+   
    private boolean hasSubTreeAccessControl = false; // flag if has a subtree
                                                     // access for this docid
    private Vector subTreeList = new Vector();
@@ -64,33 +68,25 @@
    private static Logger logMetacat = Logger.getLogger(PermissionController.class);
 
    /**
-    * Constructor for PermissionController
-    * @param myDocid      the docid need to access
-    */
-   public PermissionController(String myDocid) throws McdbException
-   {
-     // Get rid of rev number
-     docId = DocumentUtil.getSmartDocId(myDocid);
-     //hasSubTreeAccessControl = checkSubTreeAccessControl();
-   }
+	 * Constructor for PermissionController
+	 * 
+	 * @param myDocid the docid need to access
+	 */
+	public PermissionController(String myDocid) throws McdbException {
 
-   /**
-    * Constructor for PermssionController
-    * @param myDocid String
-    * @param needDeleteRev boolean
-    */
-   public PermissionController(String myDocid, boolean needDeleteRevFromDocid)
-   {
-     if (!needDeleteRevFromDocid)
-     {
-       docId = myDocid;
-     }
-     else
-     {
-         docId = DocumentUtil.getDocIdFromAccessionNumber(myDocid);
-     }
-   }
+		// find the guid if we can
+		String docId = null;
+		int rev = -1;
 
+		// get the parts
+		docId = DocumentUtil.getSmartDocId(myDocid);
+		rev = DocumentUtil.getRevisionFromAccessionNumber(myDocid);
+
+		// this is what we really want
+		guid = IdentifierManager.getInstance().getGUID(docId, rev);
+
+	}
+
    /**
     * Return if a document has subtree access control
     */
@@ -147,15 +143,15 @@
     //if the requested document is access documents and requested permission
     //is "write", the user should have "all" right
 
-    if (isAccessDocument(docId) && (permission == AccessControlInterface.WRITE))
+    if (isAccessDocument() && (permission == AccessControlInterface.WRITE))
     {
 
-      hasPermission = hasPermission(userPackage,docId, 7);// 7 is all permission
+      hasPermission = hasPermission(userPackage, 7);// 7 is all permission
     }//if
     else //in other situation, just check the request permission
     {
       // Check for @permission on @docid for @user and/or @groups
-      hasPermission = hasPermission(userPackage,docId, permission);
+      hasPermission = hasPermission(userPackage, permission);
     }//else
 
     return hasPermission;
@@ -169,8 +165,7 @@
     * @param docid, document identifier to check on
     * @param permission, permission (write or all...) to check for
     */
-  private boolean hasPermission(String [] principals, String docId,
-                                           int permission)
+  private boolean hasPermission(String [] principals, int permission)
                          throws SQLException
   {
     long startId = TOPLEVELSTARTNODEID;// this is for top level, so startid is 0
@@ -178,7 +173,7 @@
     {
       //first, if there is a docid owner in user package, return true
       //because doc owner has all permssion
-      if (containDocumentOwner(principals, docId))
+      if (containDocumentOwner(principals))
       {
 
           return true;
@@ -186,10 +181,10 @@
 
       //If there is no owner in user package, checking the table
       //check perm_order
-      if (isAllowFirst(principals, docId, startId))
+      if (isAllowFirst(principals, startId))
       {
 
-        if (hasExplicitDenyRule(principals, docId, permission, startId))
+        if (hasExplicitDenyRule(principals, permission, startId))
         {
           //if it is allowfirst and has deny rule(either explicit )
           //deny access
@@ -196,7 +191,7 @@
 
           return false;
         }//if
-        else if ( hasAllowRule(principals, docId, permission, startId))
+        else if ( hasAllowRule(principals, permission, startId))
         {
           //if it is allowfirst and hasn't deny rule and has allow rule
           //allow access
@@ -212,7 +207,7 @@
      }//if isAllowFirst
      else //denyFirst
      {
-       if (hasAllowRule(principals, docId, permission, startId))
+       if (hasAllowRule(principals, permission, startId))
        {
          //if it is denyFirst and has allow rule, allow access
          return true;
@@ -251,14 +246,15 @@
      // from inlinedataId directly. You should get it from eml document itself
      String []userPackage = createUsersPackage(user, groups);
      try {
-        if (containDocumentOwner(userPackage, docId))
+        if (containDocumentOwner(userPackage))
          {
            return true;
          }
          else
          {
-             PermissionController controller =
-                                   new PermissionController(inlineDataId, false);
+        	 // is a funky inline data id with the extra part, so we set it manually
+             PermissionController controller = new PermissionController(guid);
+             controller.guid = inlineDataId;
              return controller.hasPermission(user, groups, myPermission);
          }
     } catch (SQLException e) {
@@ -318,7 +314,7 @@
     //for the document owner return null(no unaccessable subtree)
     try
     {
-      if (containDocumentOwner(principals, docId))
+      if (containDocumentOwner(principals))
       {
        return resultUnaccessableSubTree;
       }
@@ -337,10 +333,10 @@
 
         try
         {
-          if (isAllowFirst(principals, docId, startId))
+          if (isAllowFirst(principals, startId))
           {
 
-            if (hasExplicitDenyRule(principals, docId, permission, startId ))
+            if (hasExplicitDenyRule(principals, permission, startId ))
             {
 
              //if it is allowfirst and has deny rule
@@ -350,7 +346,7 @@
                 resultUnaccessableSubTree.put(new Long(startId), tree);
               }
             }//if
-            else if ( hasAllowRule(principals, docId, permission, startId))
+            else if ( hasAllowRule(principals, permission, startId))
             {
               //if it is allowfirst and hasn't deny rule and has allow rule
               //allow access do nothing
@@ -368,7 +364,7 @@
           }//if isAllowFirst
           else //denyFirst
           {
-            if (hasAllowRule(principals, docId, permission,startId))
+            if (hasAllowRule(principals, permission,startId))
             {
               //if it is denyFirst and has allow rule, allow access, do nothing
 
@@ -463,8 +459,16 @@
 	 * @param docId,
 	 *            the document id need to be checked
 	 */
-	private boolean isAccessDocument(String docId) throws SQLException {
-		// detele the rev number if docid contains it
+	private boolean isAccessDocument() throws SQLException {
+		// get the docid from the guid
+		String docId = null;
+		try {
+			docId = IdentifierManager.getInstance().getLocalId(guid);
+		} catch (McdbDocNotFoundException e) {
+			return false;
+			//throw new SQLException(e);
+		}
+
 		docId = DocumentUtil.getDocIdFromString(docId);
 		PreparedStatement pStmt = null;
 		DBConnection conn = null;
@@ -520,9 +524,20 @@
 	 * @param docid,
 	 *            the id of given documents
 	 */
-  private boolean containDocumentOwner( String[] principals, String docId)
+  private boolean containDocumentOwner(String[] principals)
                     throws SQLException
   {
+	 
+	// get the docid  
+	String docId = null;
+	try {
+		docId = IdentifierManager.getInstance().getLocalId(guid);
+		docId = DocumentUtil.getDocIdFromString(docId);
+	} catch (McdbDocNotFoundException e) {
+		// should be true if we own the parent doc, but likely won't be checked in that case
+		return false;
+	}
+	
     int lengthOfArray=principals.length;
     boolean hasRow;
     PreparedStatement pStmt=null;
@@ -593,8 +608,7 @@
     * @param principals, list of names of principals to check for
     * @param docid, document identifier to check for
     */
-  private boolean isAllowFirst(String [] principals, String docId,
-                               long startId)
+  private boolean isAllowFirst(String [] principals, long startId)
                   throws SQLException, Exception
   {
     int lengthOfArray=principals.length;
@@ -608,14 +622,19 @@
     {
       //top level
       topLever = true;
-      sql = "SELECT perm_order FROM xml_access " +
-    "WHERE lower(principal_name) = ? AND docid = ? AND startnodeid is NULL";
+      sql = 
+    	  "SELECT perm_order FROM xml_access " +
+		    "WHERE lower(principal_name) = ? " +
+		    "AND guid = ? " +
+		    "AND startnodeid is NULL";
     }
     else
     {
       //sub tree level
       sql = "SELECT perm_order FROM xml_access " +
-        "WHERE lower(principal_name)= ? AND docid = ? AND startnodeid = ?";
+        "WHERE lower(principal_name) = ? " +
+        "AND guid = ? " +
+        "AND startnodeid = ?";
     }
 
     try
@@ -632,8 +651,8 @@
       {
         //bind value
         pStmt.setString(1, principals[i]);//user name
-        pStmt.setString(2, docId);//docid
-
+        pStmt.setString(2, guid);//guid
+        
         // if subtree, we need set subtree id
         if (!topLever)
         {
@@ -681,7 +700,7 @@
     //docid. So throw a exception.
 
     throw new Exception("PermissionController.isAllowFirst - There is no permission record for user "+ principals[0] + 
-                        " at document " + docId);
+                        " at document " + guid);
 
   }//isAllowFirst
 
@@ -694,8 +713,7 @@
     * @param docid, document identifier to check for
     * @param permission, the permssion need to check
     */
-  private boolean hasAllowRule(String [] principals, String docId,
-                                  int permission, long startId)
+  private boolean hasAllowRule(String [] principals, int permission, long startId)
                   throws SQLException, Exception
  {
    int lengthOfArray=principals.length;
@@ -704,7 +722,6 @@
    PreparedStatement pStmt = null;
    int permissionValue=permission;
    int permissionValueInTable;
-   int ticketCount;
    DBConnection conn = null;
    int serialNumber = -1;
    boolean topLever = false;
@@ -713,14 +730,22 @@
    {
      // for toplevel
      topLever = true;
-     sql = "SELECT permission FROM xml_access WHERE docid = ? " +
-   "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid is NULL";
+     sql = "SELECT permission " +
+		"FROM xml_access " +
+ 		"WHERE guid = ? " +
+ 		"AND lower(principal_name) = ? " +
+ 		"AND perm_type = ? " +
+ 		"AND startnodeid is NULL";
    }
    else
    {
      topLever =false;
-     sql = "SELECT permission FROM xml_access WHERE docid = ? " +
-      "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid = ?";
+     sql = "SELECT permission " +
+     		"FROM xml_access " +
+     		"WHERE guid = ? " +
+     		"AND lower(principal_name) = ? " +
+     		"AND perm_type = ? " +
+     		"AND startnodeid = ?";
    }
    try
    {
@@ -733,7 +758,7 @@
     //function will assign begin_time=sysdate
     pStmt = conn.prepareStatement(sql);
     //bind docid, perm_type
-    pStmt.setString(1, docId);
+    pStmt.setString(1, guid);
     pStmt.setString(3, AccessControlInterface.ALLOW);
 
     // if subtree lever, need to set subTreeId
@@ -794,7 +819,7 @@
     * @param docid, document identifier to check for
     * @param permission, the permssion need to check
     */
-  private boolean hasExplicitDenyRule(String [] principals, String docId,
+  private boolean hasExplicitDenyRule(String [] principals,
                                       int permission, long startId)
                   throws SQLException
  {
@@ -812,14 +837,22 @@
    if (startId == TOPLEVELSTARTNODEID)
    {
      topLevel = true;
-     sql = "SELECT permission FROM xml_access WHERE docid = ? " +
-    "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid is NULL";
+     sql = "SELECT permission " +
+     		"FROM xml_access " +
+     		"WHERE guid = ? " +
+	     	"AND lower(principal_name) = ? " +
+	     	"AND perm_type = ? " +
+	     	"AND startnodeid is NULL";
    }
    else
    {
      topLevel = false;
-     sql = "SELECT permission FROM xml_access WHERE docid = ? " +
-     "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid = ?";
+     sql = "SELECT permission " +
+		"FROM xml_access " +
+		"WHERE guid = ? " +
+	  	"AND lower(principal_name) = ? " +
+	  	"AND perm_type = ? " +
+	  	"AND startnodeid = ?";
    }
 
    try
@@ -830,7 +863,7 @@
 
      pStmt = conn.prepareStatement(sql);
     //bind docid, perm_type
-    pStmt.setString(1, docId);
+    pStmt.setString(1, guid);
     pStmt.setString(3, AccessControlInterface.DENY);
 
     // subtree level need to set up subtreeid
@@ -978,19 +1011,17 @@
    * user can't read it. The key is subtree id of inlinedata, the data is
    * internal file name for the inline data which is stored as docid
    * in xml_access table or data object doc id.
-   * @param docidWithoutRev, metadata docid which should be the accessfileid
+   * @param docid (With Rev), metadata docid which should be the accessfileid
    *                         in the table
    * @param user , the name of user
    * @param groups, the group which the user belong to
    */
-   public static Hashtable<String, String> getUnReadableInlineDataIdList(String docidWithoutRev,
-                                                   String user, String[] groups,
-                                                   boolean withRevision)
+   public static Hashtable<String, String> getUnReadableInlineDataIdList(String docid,
+                                                   String user, String[] groups)
                                                 throws McdbException
    {
-     Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docidWithoutRev,
-                              user, groups, AccessControlInterface.READSTRING,
-                              withRevision);
+     Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docid,
+                              user, groups, AccessControlInterface.READSTRING);
 
      return inlineDataList;
    }
@@ -1011,24 +1042,19 @@
                                                throws Exception
   {
     Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docidWithoutRev,
-                            user, groups, AccessControlInterface.WRITESTRING,
-                            withRevision);
+                            user, groups, AccessControlInterface.WRITESTRING);
 
     return inlineDataList;
   }
 
 
-   /*
+   /**
     * This method will get hashtable which contains a unaccessable distribution
     * inlinedata object list
     *
-    * withRevision is used to get inline id list with or without revision number
-    * e.g. when withRevision is true, temp.1.1.1, temp.1.1.2 would be returned
-    * otherwise temp.1.1 and temp.1.2 would be returned.
     */
    private static Hashtable<String, String> getUnAccessableInlineDataIdList(String docid,
-                               String user, String[] groups, String permission,
-                               boolean withRevision)
+                               String user, String[] groups, String permission)
                              throws McdbException
    {
        Hashtable<String, String> unAccessibleIdList = new Hashtable();
@@ -1047,30 +1073,19 @@
       {
         String subTreeId = (String) en.nextElement();
         String fileId = (String) allIdList.get(subTreeId);
-        //Here fileid is internal file id for line data. It stored in docid
-        // field in xml_access table. so we don't need to delete rev
-        PermissionController controller = new PermissionController(docid, false);
+        //Here fileid is internal file id for line data. It stored in guid
+        // field in xml_access table. 
+        PermissionController controller = new PermissionController(docid);
         if (!controller.hasPermissionForInlineData(user, groups, permission, fileId))
         {
-            if(withRevision)
-            {
-                logMetacat.info("PermissionController.getUnAccessableInlineDataIdList - Put subtree id " + subTreeId +
-                                         " and " + "inline data file name " +
-                                         fileId + " into " + "un" + permission +
-                                         " hash");
-                unAccessibleIdList.put(subTreeId, fileId);
+            
+            logMetacat.info("PermissionController.getUnAccessableInlineDataIdList - Put subtree id " + subTreeId +
+                                     " and " + "inline data file name " +
+                                     fileId + " into " + "un" + permission +
+                                     " hash");
+            unAccessibleIdList.put(subTreeId, fileId);
 
-            }
-            else
-            {
-                logMetacat.info("PermissionController.getUnAccessableInlineDataIdList - Put subtree id " + subTreeId +
-                                         " and " + "inline data file name " +
-                                         DocumentUtil.getInlineDataIdWithoutRev(fileId) +
-                                         " into " + "un" + permission +
-                                         " hash");
-                unAccessibleIdList.put(subTreeId, 
-                		DocumentUtil.getInlineDataIdWithoutRev(fileId));
-            }
+                        
         }
       }
       return unAccessibleIdList;
@@ -1085,8 +1100,11 @@
    private static Hashtable getAllInlineDataIdList(String docid) throws SQLException
    {
      Hashtable inlineDataList = new Hashtable();
-     String sql = "SELECT subtreeid, docid FROM xml_access WHERE " +
-                   "accessfileid = ? AND subtreeid  IS NOT NULL";
+     String sql = 
+    	 "SELECT subtreeid, guid " +
+    	 "FROM xml_access " +
+    	 "WHERE accessfileid = ? " +
+    	 "AND subtreeid IS NOT NULL";
      PreparedStatement pStmt=null;
      ResultSet rs=null;
      DBConnection conn=null;
Index: src/edu/ucsb/nceas/metacat/DocumentImpl.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 6744)
@@ -1268,15 +1268,14 @@
                     // if it is inline data first to get the inline data
                     // internal id
                     String fileName = currentNode.getNodeData();
-                    String accessfileName = 
-                    	DocumentUtil.getDocIdWithoutRevFromInlineDataID(fileName);
+                    // use full docid with revision
+                    String accessfileName = fileName; //DocumentUtil.getDocIdWithoutRevFromInlineDataID(fileName);
+                    
                     // check if user has read permision for this inline data
                     boolean readInlinedata = false;
                     try {
                         Hashtable<String, String> unReadableInlineDataList =
-                            PermissionController
-                                .getUnReadableInlineDataIdList(accessfileName,
-                                        user, groups, true);
+                            PermissionController.getUnReadableInlineDataIdList(accessfileName, user, groups);
                         if (!unReadableInlineDataList.containsValue(fileName)) {
                             readInlinedata = true;
                         }
@@ -1417,10 +1416,9 @@
 			
 			// get a list of inline data sections that are not readable
 			// by this user
+			String fullDocid = docid + "." + rev;
             Hashtable<String, String> unReadableInlineDataList =
-                PermissionController
-                    .getUnReadableInlineDataIdList(docid,
-                            user, groups, true);
+                PermissionController.getUnReadableInlineDataIdList(fullDocid, user, groups);
             
             // If this is for each unreadable section, strip the inline data
 			// from the doc
@@ -2753,13 +2751,17 @@
         }
 
         if (action.equals("UPDATE")) {
-            // check for 'write' permission for 'user' to update this document
-            if (!hasWritePermission(user, groups, accnum) 
+			// check for 'write' permission for 'user' to update this document
+        	// use the previous revision to check the permissions
+            String docIdWithoutRev = DocumentUtil.getSmartDocId(accnum);
+        	int latestRev = DBUtil.getLatestRevisionInDocumentTable(docIdWithoutRev);
+        	String latestDocId = docIdWithoutRev + "." + latestRev;
+            if (!hasWritePermission(user, groups, latestDocId) 
             		&& !AuthUtil.isAdministrator(user, groups)) {
                 throw new Exception(
                     "User " + user
                     + " does not have permission to update XML Document #"
-                    + accnum); }
+                    + latestDocId); }
         }
         XMLReader parser = null;
         try {
@@ -3267,35 +3269,10 @@
             
             // Now delete it from xml_access table
             /*************** DO NOT DELETE ACCESS - need to archive this ******************/
-//            pstmt = conn.prepareStatement(
-//                    "DELETE FROM xml_access WHERE accessfileid = ?");
-//            pstmt.setString(1, docid);
-//            logMetacat.debug("DocumentImpl.delete - executing SQL: " + pstmt.toString());
-//            pstmt.execute();
-//            pstmt.close();
-//            conn.increaseUsageCount(1);
-//            double afterDeleteXmlAccess1 = System.currentTimeMillis()/1000;
-//            logMetacat.info("DocumentImpl.delete - The deleting xml_access base one accessfileid time is "+(afterDeleteXmlAccess1 - afterDeleteIndex ));
-//            pstmt = conn.prepareStatement(
-//                    "DELETE FROM xml_access WHERE docid = ?");
-//            pstmt.setString(1, docid);
-//            logMetacat.debug("DocumentImpl.delete - executing SQL: " + pstmt.toString());
-//            pstmt.execute();
-//            pstmt.close();
-//            conn.increaseUsageCount(1);
             double afterDeleteXmlAccess2 = System.currentTimeMillis()/1000;
-//            logMetacat.info("DocumentImpl.delete - The deleting xml_access base on docid time is "+(afterDeleteXmlAccess2 - afterDeleteXmlAccess1 ));
-            /******* END DELETE ACCESS *************/
+            /******* END DELETE ACCESS *************/            
+            // Delete enteries from xml_queryresult
 
-            
-            // Delete enteries from xml_queryresult
-//            pstmt = conn.prepareStatement(
-//                    "DELETE FROM xml_queryresult WHERE docid = ?");
-//            pstmt.setString(1, docid);
-//            logMetacat.debug("DocumentImpl.delete - running sql: " + pstmt.toString());
-//            pstmt.execute();
-//            pstmt.close();
-//            conn.increaseUsageCount(1);
             try {
                 XMLQueryresultAccess xmlQueryresultAccess = new XMLQueryresultAccess();
                 xmlQueryresultAccess.deleteXMLQueryresulForDoc(docid);
Index: src/edu/ucsb/nceas/metacat/MetacatHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/MetacatHandler.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/MetacatHandler.java	(revision 6744)
@@ -658,9 +658,9 @@
             if (inlineDataId == null || inlineDataId.equals("")) {
                 throw new Exception("You didn't specify requested inlinedataid"); }
             
-            // check for permission
-            docId = 
-                DocumentUtil.getDocIdWithoutRevFromInlineDataID(inlineDataId);
+            // check for permission, use full docid with revision
+            docId = DocumentUtil.getDocIdFromInlineDataID(inlineDataId);
+
             PermissionController controller = new PermissionController(docId);
             // check top level read permission
             if (!controller.hasPermission(user, groups,
@@ -672,10 +672,8 @@
                 //check data access level
                 try {
                     Hashtable<String,String> unReadableInlineDataList =
-                            PermissionController.getUnReadableInlineDataIdList(docId,
-                            user, groups, false);
-                    String inlineDataIdWithoutRev = DocumentUtil.getInlineDataIdWithoutRev(inlineDataId);
-                    if (unReadableInlineDataList.containsValue(inlineDataIdWithoutRev)) {
+                            PermissionController.getUnReadableInlineDataIdList(docId, user, groups);
+                    if (unReadableInlineDataList.containsValue(inlineDataId)) {
                         throw new Exception("User " + user
                                 + " doesn't have permission " + " to read inlinedata "
                                 + inlineDataId);
@@ -1851,7 +1849,7 @@
                   // handle inserts
                   try {
                 	// create the system metadata  
-                    sysMeta = SystemMetadataFactory.createSystemMetadata(newdocid, true);
+                    sysMeta = SystemMetadataFactory.createSystemMetadata(newdocid, false);
                     
                     // save it to the map
                     HazelcastService.getInstance().getSystemMetadataMap().put(sysMeta.getIdentifier(), sysMeta);
@@ -2994,7 +2992,7 @@
                                     username, groupnames);
                             
                             // generate system metadata about the doc
-                            SystemMetadata sm = SystemMetadataFactory.createSystemMetadata(docid, true);
+                            SystemMetadata sm = SystemMetadataFactory.createSystemMetadata(docid, false);
 							
 					        // manage it in the store
                             HazelcastService.getInstance().getSystemMetadataMap().put(sm.getIdentifier(), sm);
Index: src/edu/ucsb/nceas/metacat/util/DocumentUtil.java
===================================================================
--- src/edu/ucsb/nceas/metacat/util/DocumentUtil.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/util/DocumentUtil.java	(revision 6744)
@@ -390,12 +390,12 @@
      * Method to get docidwithrev from eml2 inline data id The eml inline data
      * id would look like eml.200.2.3
      */
-    public static String getDocIdWithoutRevFromInlineDataID(String inlineDataID)
+    public static String getDocIdFromInlineDataID(String inlineDataID)
     {
         String docidWithoutRev = null;
         if (inlineDataID == null) { return docidWithoutRev; }
         char charSeperator = separator;
-        int targetNumberOfSeperator = 2;// we want to know his index
+        int targetNumberOfSeperator = 3;// we want to know his index
         int numberOfSeperator = 0;
         for (int i = 0; i < inlineDataID.length(); i++) {
             // meet seperator, increase number of seperator
Index: src/edu/ucsb/nceas/metacat/dataone/SystemMetadataFactory.java
===================================================================
--- src/edu/ucsb/nceas/metacat/dataone/SystemMetadataFactory.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/dataone/SystemMetadataFactory.java	(revision 6744)
@@ -286,8 +286,8 @@
 			}
 		}
 		
-		// look up the access control policy we have in metacat already to make sure it is in the SM
-		AccessPolicy accessPolicy = IdentifierManager.getInstance().getAccessPolicyByLocalId(docidWithoutRev);
+		// look up the access control policy we have in metacat
+		AccessPolicy accessPolicy = IdentifierManager.getInstance().getAccessPolicy(guid);
 		sysMeta.setAccessPolicy(accessPolicy);
 		
 		// authoritative node
@@ -325,123 +325,126 @@
 	            List<Identifier> dataIds = new ArrayList<Identifier>();
 				
 				// iterate through data objects described by the EML
-				for (int j = 0; j < dataPackage.getEntityList().length; j++) {
-
-					String dataDocUrl = dataPackage.getEntityList()[j].getURL();
-					String dataDocMimeType = dataPackage.getEntityList()[j].getDataFormat();
-					// default to binary
-					if (dataDocMimeType == null) {
-						dataDocMimeType = ObjectFormatCache.getInstance()
-								.getFormat("application/octet-stream")
-								.getFormatId().getValue();
-					}
-					String dataDocLocalId = "";
-					logMetacat.debug("Data local ID: " + dataDocLocalId);
-					logMetacat.debug("Data URL     : " + dataDocUrl);
-					logMetacat.debug("Data mime    : " + dataDocMimeType);
-
-					// we only handle ecogrid urls right now
-					String ecogridPrefix = "ecogrid://knb/";
-					if (dataDocUrl.trim().startsWith(ecogridPrefix)) {
-						dataDocLocalId = dataDocUrl.substring(dataDocUrl
-								.indexOf(ecogridPrefix)
-								+ ecogridPrefix.length());
-
-						// look up the guid for the data
-						String dataDocid = DocumentUtil.getSmartDocId(dataDocLocalId);
-						int dataRev = DocumentUtil.getRevisionFromAccessionNumber(dataDocLocalId);
-
-						// check if data system metadata exists already
-						SystemMetadata dataSysMeta = null;
-						String dataGuidString = null;
-						Identifier dataGuid = new Identifier();
-						try {
-							// look for the identifier
-							dataGuidString = IdentifierManager.getInstance().getGUID(dataDocid, dataRev);
-							// set it
-							dataGuid.setValue(dataGuidString);
-							// look up the system metadata
-							try {
-								dataSysMeta = HazelcastService.getInstance().getSystemMetadataMap().get(dataGuid);
-							} catch (Exception e) {
-								// probably not in the system
-								dataSysMeta = null;
-							}
-							//dataSysMeta = IdentifierManager.getInstance().getSystemMetadata(dataGuidString);
-						} catch (McdbDocNotFoundException nf) {
-							// we didn't find it
-							dataSysMeta = null;
+	            if (dataPackage.getEntityList() != null) {
+					for (int j = 0; j < dataPackage.getEntityList().length; j++) {
+	
+						String dataDocUrl = dataPackage.getEntityList()[j].getURL();
+						String dataDocMimeType = dataPackage.getEntityList()[j].getDataFormat();
+						// default to binary
+						if (dataDocMimeType == null) {
+							dataDocMimeType = ObjectFormatCache.getInstance()
+									.getFormat("application/octet-stream")
+									.getFormatId().getValue();
 						}
-							
-						// we'll have to generate it	
-						if (dataSysMeta == null) {
-							// System metadata for data doesn't exist yet, so create it
-							logMetacat.debug("There was not an existing system metadata document for " + dataDocLocalId);
+						String dataDocLocalId = "";
+						logMetacat.debug("Data local ID: " + dataDocLocalId);
+						logMetacat.debug("Data URL     : " + dataDocUrl);
+						logMetacat.debug("Data mime    : " + dataDocMimeType);
+	
+						// we only handle ecogrid urls right now
+						String ecogridPrefix = "ecogrid://knb/";
+						if (dataDocUrl.trim().startsWith(ecogridPrefix)) {
+							dataDocLocalId = dataDocUrl.substring(dataDocUrl
+									.indexOf(ecogridPrefix)
+									+ ecogridPrefix.length());
+	
+							// look up the guid for the data
+							String dataDocid = DocumentUtil.getSmartDocId(dataDocLocalId);
+							int dataRev = DocumentUtil.getRevisionFromAccessionNumber(dataDocLocalId);
+	
+							// check if data system metadata exists already
+							SystemMetadata dataSysMeta = null;
+							String dataGuidString = null;
+							Identifier dataGuid = new Identifier();
 							try {
-								logMetacat.debug("Creating a system metadata " + "document for " + dataDocLocalId);
-								dataSysMeta = createSystemMetadata(dataDocLocalId, includeORE);
-
-								// now look it up again
+								// look for the identifier
 								dataGuidString = IdentifierManager.getInstance().getGUID(dataDocid, dataRev);
-
-								// set the guid
+								// set it
 								dataGuid.setValue(dataGuidString);
-
-								// set object format
-								logMetacat.debug("Updating system metadata for "
-												+ dataGuid.getValue() + " to "
-												+ dataDocMimeType);
+								// look up the system metadata
 								try {
-									ObjectFormatIdentifier fmt = 
-										ObjectFormatCache.getInstance().getFormat(dataDocMimeType).getFormatId();
-									dataSysMeta.setFormatId(fmt);
-								} catch (NotFound nfe) {
-									logMetacat.debug("Couldn't find format identifier for: "
-													+ dataDocMimeType
-													+ ". Setting it to application/octet-stream.");
-									ObjectFormatIdentifier newFmtid = new ObjectFormatIdentifier();
-									newFmtid.setValue("application/octet-stream");
+									dataSysMeta = HazelcastService.getInstance().getSystemMetadataMap().get(dataGuid);
+								} catch (Exception e) {
+									// probably not in the system
+									dataSysMeta = null;
 								}
-
-								// update the values
-								HazelcastService.getInstance().getSystemMetadataMap().put(dataSysMeta.getIdentifier(), dataSysMeta);
+								//dataSysMeta = IdentifierManager.getInstance().getSystemMetadata(dataGuidString);
+							} catch (McdbDocNotFoundException nf) {
+								// we didn't find it
+								dataSysMeta = null;
+							}
 								
-
-							} catch (McdbDocNotFoundException mdnf) {
-								mdnf.printStackTrace();
-								throw mdnf;
-							} catch (NumberFormatException nfe) {
-								nfe.printStackTrace();
-								throw nfe;
-							} catch (AccessionNumberException ane) {
-								ane.printStackTrace();
-								throw ane;
-							} catch (SQLException sqle) {
-								sqle.printStackTrace();
-								throw sqle;
-							} catch (NoSuchAlgorithmException nsae) {
-								nsae.printStackTrace();
-								throw nsae;
-							} catch (IOException ioe) {
-								ioe.printStackTrace();
-								throw ioe;
-							} catch (PropertyNotFoundException pnfe) {
-								pnfe.printStackTrace();
-								throw pnfe;
-							} catch (BaseException be) {
-								be.printStackTrace();
-								throw be;
-							}	
+							// we'll have to generate it	
+							if (dataSysMeta == null) {
+								// System metadata for data doesn't exist yet, so create it
+								logMetacat.debug("There was not an existing system metadata document for " + dataDocLocalId);
+								try {
+									logMetacat.debug("Creating a system metadata " + "document for " + dataDocLocalId);
+									dataSysMeta = createSystemMetadata(dataDocLocalId, includeORE);
+	
+									// now look it up again
+									dataGuidString = IdentifierManager.getInstance().getGUID(dataDocid, dataRev);
+	
+									// set the guid
+									dataGuid.setValue(dataGuidString);
+	
+									// set object format
+									logMetacat.debug("Updating system metadata for "
+													+ dataGuid.getValue() + " to "
+													+ dataDocMimeType);
+									try {
+										ObjectFormatIdentifier fmt = 
+											ObjectFormatCache.getInstance().getFormat(dataDocMimeType).getFormatId();
+										dataSysMeta.setFormatId(fmt);
+									} catch (NotFound nfe) {
+										logMetacat.debug("Couldn't find format identifier for: "
+														+ dataDocMimeType
+														+ ". Setting it to application/octet-stream.");
+										ObjectFormatIdentifier newFmtid = new ObjectFormatIdentifier();
+										newFmtid.setValue("application/octet-stream");
+									}
+	
+									// update the values
+									HazelcastService.getInstance().getSystemMetadataMap().put(dataSysMeta.getIdentifier(), dataSysMeta);
+									
+	
+								} catch (McdbDocNotFoundException mdnf) {
+									mdnf.printStackTrace();
+									throw mdnf;
+								} catch (NumberFormatException nfe) {
+									nfe.printStackTrace();
+									throw nfe;
+								} catch (AccessionNumberException ane) {
+									ane.printStackTrace();
+									throw ane;
+								} catch (SQLException sqle) {
+									sqle.printStackTrace();
+									throw sqle;
+								} catch (NoSuchAlgorithmException nsae) {
+									nsae.printStackTrace();
+									throw nsae;
+								} catch (IOException ioe) {
+									ioe.printStackTrace();
+									throw ioe;
+								} catch (PropertyNotFoundException pnfe) {
+									pnfe.printStackTrace();
+									throw pnfe;
+								} catch (BaseException be) {
+									be.printStackTrace();
+									throw be;
+								}	
+								
+							}
 							
-						}
-						
-						// part of the ORE package
-						dataIds.add(dataGuid);
-
-					} // end if (EML package)
-
-				} // end for (data entities)
-				
+							// part of the ORE package
+							dataIds.add(dataGuid);
+	
+						} // end if (EML package)
+	
+					} // end for (data entities)
+					
+	            } // data entities not null
+	            
 				// ORE map
 				if (includeORE) {
 			        if (!dataIds.isEmpty()) {
Index: src/edu/ucsb/nceas/metacat/oaipmh/provider/server/catalog/MetacatCatalog.java
===================================================================
--- src/edu/ucsb/nceas/metacat/oaipmh/provider/server/catalog/MetacatCatalog.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/oaipmh/provider/server/catalog/MetacatCatalog.java	(revision 6744)
@@ -90,59 +90,30 @@
    * that are publicly accessible
    */
   private final String QUERY =
-  "SELECT docid, doctype, date_updated " +
-  "FROM xml_documents " +
-  "WHERE doctype like 'eml://ecoinformatics.org/eml-2%' AND " + 
-  "  (docid IN " +
-  "     (SELECT docid " +
-  "      FROM xml_access " +
-  "      WHERE( (lower(principal_name) = 'public') AND " +
-  "             perm_type = 'allow' AND " +
-  "             permission > 3" +
-  "           )" +
-  "     )" +
-  "   AND " +
-  "   docid NOT IN " +
-  "     (SELECT docid " +
-  "      FROM xml_access " +
-  "      WHERE( (lower(principal_name) = 'public') AND " +
-  "             perm_type = 'deny' AND " +
-  "             perm_order ='allowFirst' AND " +
-  "             permission > 3" +
-  "           )" +
-  "     )" +
-  "  )";
+  "SELECT xd.docid, xd.doctype, xd.date_updated " +
+  "FROM xml_documents xd, identifier id " +
+  "WHERE xd.doctype like 'eml://ecoinformatics.org/eml-2%' " +
+  " AND xd.docid = id.docid " +
+  " AND xd.rev = id.rev " +
+  // ALLOW rule
+  " AND id.guid IN " +
+  "     (SELECT guid " +
+  "     FROM xml_access " +
+  "		AND lower(principal_name) = 'public' " +
+  " 	AND perm_type = 'allow' " +
+  " 	AND permission > 3" +
+  "		) " +
+  // DENY rules?
+  " AND id.guid NOT IN " +
+  "     (SELECT guid " +
+  "     FROM xml_access " +
+  "     WHERE lower(principal_name) = 'public' " +
+  "		AND perm_type = 'deny' " +
+  "		AND perm_order ='allowFirst' " +
+  "		AND permission > 3 " +
+  "     ) ";
   
   
-  /*
-   * QUERY string to determine the most recent 'date_updated' value stored
-   * in Metacat's 'xml_documents' table.
-   */
-  private final String LAST_UPDATED_QUERY =
-  "SELECT MAX(date_updated) " +
-  "FROM xml_documents " +
-  "WHERE doctype like 'eml://ecoinformatics.org/eml-2%' AND " + 
-  "  (docid IN " +
-  "     (SELECT docid " +
-  "      FROM xml_access " +
-  "      WHERE( (lower(principal_name) = 'public') AND " +
-  "             perm_type = 'allow' AND " +
-  "             permission > 3" +
-  "           )" +
-  "     )" +
-  "   AND " +
-  "   docid NOT IN " +
-  "     (SELECT docid " +
-  "      FROM xml_access " +
-  "      WHERE( (lower(principal_name) = 'public') AND " +
-  "             perm_type = 'deny' AND " +
-  "             perm_order ='allowFirst' AND " +
-  "             permission > 3" +
-  "           )" +
-  "     )" +
-  "  )";
-  
-  
 /* Constructors */
   
   public MetacatCatalog(Properties properties) {
Index: src/edu/ucsb/nceas/metacat/Sitemap.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Sitemap.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/Sitemap.java	(revision 6744)
@@ -105,9 +105,11 @@
             // TODO: make the doctype configurable in the query
             String sql =
             	"SELECT xml_documents.docid, xml_documents.rev " +
-            	"FROM xml_documents, xml_access " +
+            	"FROM xml_documents, xml_access, identifier " +
                 "WHERE xml_documents.doctype LIKE 'eml:%' " + 
-                "AND xml_documents.docid = xml_access.docid " +
+                "AND xml_documents.docid = identifier.docid " +
+                "AND xml_documents.rev = identifier.rev " +
+                "AND identifier.guid = xml_access.guid " +
                 "AND xml_access.principal_name = 'public' " +
                 "AND xml_access.perm_type = 'allow' " +
                 "order by docid, rev";
Index: src/edu/ucsb/nceas/metacat/XMLQueryresultAccess.java
===================================================================
--- src/edu/ucsb/nceas/metacat/XMLQueryresultAccess.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/XMLQueryresultAccess.java	(revision 6744)
@@ -95,20 +95,6 @@
 	 */
 	protected BaseDAO populateDAO(ResultSet resultSet) throws SQLException {
 
-//		XMLAccessDAO xmlAccessDAO = new XMLAccessDAO();
-//		xmlAccessDAO.setDocId(resultSet.getString("docid"));
-//		xmlAccessDAO.setAccessFileId(resultSet.getString("accessfileid"));
-//		xmlAccessDAO.setPrincipalName(resultSet.getString("principal_name"));
-//		xmlAccessDAO.setPermission(resultSet.getLong("permission"));
-//		xmlAccessDAO.setPermType(resultSet.getString("perm_type"));
-//		xmlAccessDAO.setPermOrder(resultSet.getString("perm_order"));
-//		xmlAccessDAO.setBeginTime(resultSet.getDate("begin_time"));
-//		xmlAccessDAO.setEndTime(resultSet.getDate("end_time"));
-//		xmlAccessDAO.setTicketCount(resultSet.getLong("ticket_count"));
-//		xmlAccessDAO.setSubTreeId(resultSet.getString("subtreeid"));
-//		xmlAccessDAO.setStartNodeId(resultSet.getString("startnodeid"));
-//		xmlAccessDAO.setEndNodeId(resultSet.getString("endnodeid"));
-
 		return null;
 	}
 	
Index: src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 6744)
@@ -337,39 +337,39 @@
         // Get the unchangable subtrees (user doesn't have write permission)
         try
         {
-            PermissionController control = new PermissionController(docid
-                    + PropertyService.getProperty("document.accNumSeparator") + revision);
-            //unChangableSubTreeHash = getUnchangableSubTree(control, user,
-            // groups);
 
-            // If the action is update and user doesn't have "ALL" permission
-            // we need to check if user update access subtree
-            if (action != null && action.equals("UPDATE")
-                    && !control.hasPermission(user, groups,
-                            AccessControlInterface.ALLSTRING) 
-                            && !AuthUtil.isAdministrator(user, groups))
-            {
-                needToCheckAccessModule = true;
-                topAccessSubTreeFromDB = getTopAccessSubTreeFromDB();
-                additionalAccessSubTreeListFromDB =
-                                         getAdditionalAccessSubTreeListFromDB();
-                referencedAccessSubTreeListFromDB =
-                                         getReferencedAccessSubTreeListFromDB();
-            }
-
             //Here is for  data object checking.
-            if (action != null && action.equals("UPDATE"))
-            {
+            if (action != null && action.equals("UPDATE")) {
+            	
+    			// we need to check if user can update access subtree			
+    			int latestRevision = DBUtil.getLatestRevisionInDocumentTable(docid);
+    			String previousDocid = 
+    				docid + PropertyService.getProperty("document.accNumSeparator") + latestRevision;
+    			
+    			PermissionController control = new PermissionController(previousDocid);
+            	
+            	 // If the action is update and user doesn't have "ALL" permission
+                // we need to check if user update access subtree
+            	if ( !control.hasPermission(user, groups, AccessControlInterface.ALLSTRING) 
+                        && !AuthUtil.isAdministrator(user, groups)) {
+                		
+                    needToCheckAccessModule = true;
+                    topAccessSubTreeFromDB = getTopAccessSubTreeFromDB();
+                    additionalAccessSubTreeListFromDB =
+                                             getAdditionalAccessSubTreeListFromDB();
+                    referencedAccessSubTreeListFromDB =
+                                             getReferencedAccessSubTreeListFromDB();
+            	}
+            	
               //info about inline data object which user doesn't have read
               //permission the info come from xml_access table
               previousUnreadableInlineDataObjectHash = PermissionController.
-                            getUnReadableInlineDataIdList(docid, user,
-                                                          groups, true);
+                            getUnReadableInlineDataIdList(previousDocid, user, groups);
 
               //info about data object which user doesn't have write permission
               // the info come from xml_accesss table
               previousUnwritableInlineDataObjectHash = PermissionController.
-                            getUnWritableInlineDataIdList(docid, user,
+                            getUnWritableInlineDataIdList(previousDocid, user,
                                                           groups, true);
 
             }
@@ -2034,9 +2034,22 @@
        String permOrder = newAccess.getPermissionOrder();
        Vector accessRule = newAccess.getAccessRules();
        String subtree     = null;
+       
        // document itself
-       deletePermissionsInAccessTableForDoc(docid);
-       writeGivenAccessRuleIntoDB(permOrder, accessRule, docid, subtree);
+       // use GUID
+       String guid = null;
+		try {
+			guid = IdentifierManager.getInstance().getGUID(docid, Integer.valueOf(revision));
+		} catch (NumberFormatException e) {
+			throw new SAXException(e.getMessage(), e);
+		} catch (McdbDocNotFoundException e) {
+			// register the default mapping now
+			guid = docid + "." + revision;
+			IdentifierManager.getInstance().createMapping(guid, guid);
+		}
+       deletePermissionsInAccessTableForDoc(guid);
+       writeGivenAccessRuleIntoDB(permOrder, accessRule, guid, subtree);
+       
        // for online data, it includes with id and without id.
        // 1. for the data with subtree id, we should ignore the ones already in
        // the hash - onlineURLIdHasAddionalAccess.
@@ -2091,12 +2104,22 @@
                                   " write to xml_access table");
         throw new SAXException("The access object is null");
       }
-       // get rid of rev from dataId
-       //dataId = MetacatUtil.getDocIdFromString(dataId);
-       //String permOrder = accessSection.getPermissionOrder();
+      
+      // geet the guid, not the docid alone
+      String guid = null;
+		try {
+			guid = IdentifierManager.getInstance().getGUID(docid, Integer.valueOf(revision));
+		} catch (NumberFormatException e) {
+			throw new SAXException(e.getMessage(), e);
+		} catch (McdbDocNotFoundException e) {
+			// register the default mapping now
+			guid = docid + "." + revision;
+			IdentifierManager.getInstance().createMapping(guid, guid);
+		}
+      
        String sql = null;
        PreparedStatement pstmt = null;
-       sql = "INSERT INTO xml_access (docid, principal_name, permission, "
+       sql = "INSERT INTO xml_access (guid, principal_name, permission, "
                + "perm_type, perm_order, accessfileid, subtreeid) VALUES "
                + " (?, ?, ?, ?, ?, ?, ?)";
 
@@ -2108,9 +2131,9 @@
            connection.increaseUsageCount(1);
            // Bind the values to the query
            pstmt.setString(1, dataId);
-           logMetacat.info("Docid in accesstable: " + docid);
-           pstmt.setString(6, docid);
-           logMetacat.info("Accessfileid in accesstable: " + docid);
+           logMetacat.info("guid in accesstable: " + dataId);
+           pstmt.setString(6, guid);
+           logMetacat.info("Accessfileid in accesstable: " + guid);
            pstmt.setString(5, permOrder);
            logMetacat.info("PermOder in accesstable: " + permOrder);
            pstmt.setString(7, subTreeId);
@@ -2165,16 +2188,16 @@
     }//writeGivenAccessRuleIntoDB
 
 
-    /* Delete from db all permission for resources related to @docid if any. */
-    private void deletePermissionsInAccessTableForDoc(String docid)
+    /* Delete from db all permission for resources related guid, if any. */
+    private void deletePermissionsInAccessTableForDoc(String guid)
             throws SAXException
     {
         PreparedStatement pstmt = null;
         try {
-        	String sql = "DELETE FROM xml_access WHERE docid = ?";
-            // delete all acl records for resources related to @aclid if any
+        	String sql = "DELETE FROM xml_access WHERE guid = ? ";
+            // delete all acl records for resources related to guid if any
             pstmt = connection.prepareStatement(sql);
-            pstmt.setString(1, docid);
+            pstmt.setString(1, guid);
             // Increase DBConnection usage count
             connection.increaseUsageCount(1);
             pstmt.execute();
@@ -2198,11 +2221,12 @@
        {
     	   String sql = 
     		   "DELETE FROM xml_access " +
-    		   "WHERE accessfileid = ? " +
+    		   "WHERE accessfileid IN (SELECT guid from identifier where docid = ? and rev = ?) " +
                "AND subtreeid = ?";
            pstmt = connection.prepareStatement(sql);
            pstmt.setString(1, docid);
-           pstmt.setString(2, subtreeid);
+           pstmt.setInt(2, Integer.valueOf(revision));
+           pstmt.setString(3, subtreeid);
            // Increase DBConnection usage count
            connection.increaseUsageCount(1);
            pstmt.execute();
@@ -2232,9 +2256,11 @@
        {
     	   String sql = 
     		   "DELETE FROM xml_access " +
-    		   "WHERE accessfileid = ? AND subtreeid IS NOT NULL";
+    		   "WHERE accessfileid IN (SELECT guid from identifier where docid = ? and rev = ?) " +
+    		   "AND subtreeid IS NOT NULL";
            pstmt = connection.prepareStatement(sql);
            pstmt.setString(1, docid);
+           pstmt.setInt(2, Integer.valueOf(revision));
            // Increase DBConnection usage count
            connection.increaseUsageCount(1);
            pstmt.execute();
@@ -2653,11 +2679,11 @@
 
     /*
      * This method will handle data file in online url. If the data file is in
-     * ecogrid protocol, then the datafile identifier(without rev) be returned.
+     * ecogrid protocol, then the datafile identifier (guid) be returned.
      * otherwise, null will be returned.
      * If the data file doesn't exsit in xml_documents or
      * xml_revision table, or the user has all permission to the data file if
-     * the docid already existed, the data file id (without rev)will be returned
+     * the docid already existed, the data file id (guid) will be returned
      * NEED to do:
      * We should also need to implement http and ftp. Those
      * external files should be download and assign a data file id to it.
@@ -2666,6 +2692,8 @@
     {
       logMetacat.warn("The url is "+ url);
       String docid = null;
+      String guid = null;
+
       // if the url is not a ecogrid protocol, null will be getten
       String accessionNumber =
     	  DocumentUtil.getAccessionNumberFromEcogridIdentifier(url);
@@ -2674,6 +2702,14 @@
         // handle ecogrid protocol
         // get rid of revision number to get the docid.
         docid = DocumentUtil.getDocIdFromAccessionNumber(accessionNumber);
+        // use the guid instead
+        int rev = DocumentUtil.getRevisionFromAccessionNumber(accessionNumber);
+		try {
+			guid = IdentifierManager.getInstance().getGUID(docid, rev);
+		} catch (McdbDocNotFoundException e1) {
+			guid = docid + "." + rev;
+			IdentifierManager.getInstance().createMapping(guid, guid);
+		}
         onlineDataFileIdInRelationVector.add(docid);
         try
         {
@@ -2680,7 +2716,7 @@
 
           if (!AccessionNumber.accNumberUsed(docid))
           {
-            return docid;
+            return guid;
           }
           PermissionController controller = new
               PermissionController(accessionNumber);
@@ -2687,12 +2723,12 @@
           if (controller.hasPermission(
               user, groups, AccessControlInterface.ALLSTRING))
           {
-            return docid;
+            return guid;
           }
           else
           {
             throw new SAXException("User: " + user + " does not have permission to update " +
-                  "access rules for data file "+ docid);
+                  "access rules for data file "+ guid);
           }
         }//try
         catch(Exception e)
@@ -2703,7 +2739,7 @@
           throw new SAXException(e.getMessage());
         }
       }
-      return docid;
+      return guid;
     }
 
     private void compareElementNameSpaceAttributes(Stack unchangableNodeStack,
Index: src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 6744)
@@ -195,15 +195,20 @@
 				updateDate);
 		// Get the unchangeable subtrees (user doesn't have write permission)
 		try {
-			PermissionController control = new PermissionController(docid
-					+ PropertyService.getProperty("document.accNumSeparator") + revision);
 
-			// If the action is update and user doesn't have "ALL" permission
-			// we need to check if user can update access subtree			
-			if (!control.hasPermission(user, groups, AccessControlInterface.ALLSTRING)
-					&& action != null && action.equals("UPDATE")) {
-				needToCheckAccessModule = true;
-				unChangeableAccessSubTreeVector = getAccessSubTreeListFromDB();
+			if (action.equals("UPDATE")) {
+				// If the action is update and user doesn't have "ALL" permission
+				// we need to check if user can update access subtree			
+				int latestRevision = DBUtil.getLatestRevisionInDocumentTable(docid);
+				String previousDocid = 
+					docid + PropertyService.getProperty("document.accNumSeparator") + latestRevision;
+				
+				PermissionController control = new PermissionController(previousDocid );
+				if (!control.hasPermission(user, groups, AccessControlInterface.ALLSTRING)
+						&& action != null) {
+					needToCheckAccessModule = true;
+					unChangeableAccessSubTreeVector = getAccessSubTreeListFromDB();
+				}
 			}
 
 		} catch (Exception e) {
@@ -1188,7 +1193,7 @@
 	/* The method to write all access rule into db */
 	private void writeAccessRuleToDB() throws SAXException {
 		// Delete old permssion
-		deletePermissionsInAccessTable(docid);
+		deletePermissionsInAccessTable();
 		// write top leve access rule
 		writeTopLevelAccessRuleToDB();
 		// write additional access rule
@@ -1376,8 +1381,12 @@
 
 				if (distributionType == DistributionSection.DATA_DISTRIBUTION) {
 					try {
-						PermissionController controller = new PermissionController(
-								distributionSection.getDataFileName(), false);
+						// check for the previous version for permissions
+						int latestRevision = DBUtil.getLatestRevisionInDocumentTable(distributionSection.getDataFileName());
+						String previousDocid = 
+							distributionSection.getDataFileName() + PropertyService.getProperty("document.accNumSeparator") + latestRevision;
+						PermissionController controller = new PermissionController(previousDocid);
+						
 						if (AccessionNumber.accNumberUsed(docid)
 								&& !controller.hasPermission(user, groups, "WRITE")) {
 							throw new SAXException(UPDATEACCESSERROR);
@@ -1393,8 +1402,12 @@
 					}
 				} else if (distributionType == DistributionSection.INLINE_DATA_DISTRIBUTION && action == "UPDATE") {
 					try {
-						PermissionController controller = new PermissionController(
-								docid, false);
+						
+						// check for the previous version for permissions
+						int latestRevision = DBUtil.getLatestRevisionInDocumentTable(docid);
+						String previousDocid = 
+							docid + PropertyService.getProperty("document.accNumSeparator") + latestRevision;
+						PermissionController controller = new PermissionController(previousDocid);
 
 						if (!controller.hasPermission(user, groups, "WRITE")) {
 							throw new SAXException(UPDATEACCESSERROR);
@@ -1426,15 +1439,26 @@
 			throw new SAXException("The access object is null");
 		}
 
+		String guid = null;
+		try {
+			guid = IdentifierManager.getInstance().getGUID(docid, Integer.valueOf(revision));
+		} catch (NumberFormatException e) {
+			throw new SAXException(e.getMessage(), e);
+		} catch (McdbDocNotFoundException e) {
+			// register the default mapping now
+			guid = docid + "." + revision;
+			IdentifierManager.getInstance().createMapping(guid, guid);
+		}
+		
 		String permOrder = accessSection.getPermissionOrder();
 		String sql = null;
 		PreparedStatement pstmt = null;
 		if (topLevel) {
-			sql = "INSERT INTO xml_access (docid, principal_name, permission, "
+			sql = "INSERT INTO xml_access (guid, principal_name, permission, "
 					+ "perm_type, perm_order, accessfileid) VALUES "
 					+ " (?, ?, ?, ?, ?, ?)";
 		} else {
-			sql = "INSERT INTO xml_access (docid,principal_name, "
+			sql = "INSERT INTO xml_access (guid,principal_name, "
 					+ "permission, perm_type, perm_order, accessfileid, subtreeid"
 					+ ") VALUES" + " (?, ?, ?, ?, ?, ?, ?)";
 		}
@@ -1444,16 +1468,17 @@
 			// Increase DBConnection usage count
 			connection.increaseUsageCount(1);
 			// Bind the values to the query
-			pstmt.setString(6, docid);
-			logMetacat.debug("Accessfileid in accesstable: " + docid);
+			pstmt.setString(6, guid);
+			logMetacat.debug("Accessfileid in accesstable: " + guid);
 			pstmt.setString(5, permOrder);
 			logMetacat.debug("PermOder in accesstable: " + permOrder);
 			// if it is not top level, set subsection id
 			if (topLevel) {
-				pstmt.setString(1, docid);
-				logMetacat.debug("Docid in accesstable: " + docid);
+				pstmt.setString(1, guid);
+				logMetacat.debug("Guid in accesstable: " + guid);
 			}
 			if (!topLevel) {
+				// TODO: look up guid?
 				pstmt.setString(1, accessSection.getDataFileName());
 				logMetacat.debug("Docid in accesstable: " + inlineDataFileName);
 
@@ -1503,79 +1528,18 @@
 
 	}// writeGivenAccessRuleIntoDB
 
-	/* Write a gaven access rule into db */
-	private void writeAccessRuleForRelatedDataFileIntoDB(AccessSection accessSection,
-			String dataId) throws SAXException {
-		if (accessSection == null) {
-			throw new SAXException("The access object is null");
-		}
-		// get rid of rev from dataId
-		// dataId = MetacatUtil.getDocIdFromString(dataId);
-		String permOrder = accessSection.getPermissionOrder();
-		String sql = null;
-		PreparedStatement pstmt = null;
-		sql = "INSERT INTO xml_access (docid, principal_name, permission, "
-				+ "perm_type, perm_order, accessfileid) VALUES " + " (?, ?, ?, ?, ?, ?)";
+	
 
-		try {
-
-			pstmt = connection.prepareStatement(sql);
-			// Increase DBConnection usage count
-			connection.increaseUsageCount(1);
-			// Bind the values to the query
-			pstmt.setString(1, dataId);
-			logMetacat.debug("Docid in accesstable: " + docid);
-			pstmt.setString(6, docid);
-			logMetacat.debug("Accessfileid in accesstable: " + docid);
-			pstmt.setString(5, permOrder);
-			logMetacat.debug("PermOder in accesstable: " + permOrder);
-			// if it is not top level, set subsection id
-
-			Vector<AccessRule> accessRules = accessSection.getAccessRules();
-			// go through every rule
-			for (int i = 0; i < accessRules.size(); i++) {
-				AccessRule rule = accessRules.elementAt(i);
-				String permType = rule.getPermissionType();
-				int permission = rule.getPermission();
-				pstmt.setInt(3, permission);
-				logMetacat.debug("permission in accesstable: " + permission);
-				pstmt.setString(4, permType);
-				logMetacat.debug("Permtype in accesstable: " + permType);
-				// go through every principle in rule
-				Vector<String> nameVector = rule.getPrincipal();
-				for (int j = 0; j < nameVector.size(); j++) {
-					String prName = nameVector.elementAt(j);
-					pstmt.setString(2, prName);
-					logMetacat.debug("Principal in accesstable: " + prName);
-					logMetacat.debug("running sql: " + pstmt.toString());
-					pstmt.execute();
-				}// for
-			}// for
-			pstmt.close();
-		}// try
-		catch (SQLException e) {
-			throw new SAXException("EMLSAXHandler.writeAccessRuletoDB(): "
-					+ e.getMessage());
-		}// catch
-		finally {
-			try {
-				pstmt.close();
-			} catch (SQLException ee) {
-				throw new SAXException("EMLSAXHandler.writeAccessRuletoDB(): "
-						+ ee.getMessage());
-			}
-		}// finally
-
-	}// writeAccessRuleForRalatedDataFileIntoDB
-
-	/* Delete from db all permission for resources related to @aclid if any. */
-	private void deletePermissionsInAccessTable(String aclid) throws SAXException {
+	/* Delete from db all permission for resources related to the document, if any */
+	private void deletePermissionsInAccessTable() throws SAXException {
 		PreparedStatement pstmt = null;
 		try {
-			String sql = "DELETE FROM xml_access WHERE accessfileid = ?";
+			String sql = "DELETE FROM xml_access " +
+					"WHERE accessfileid IN (SELECT guid from identifier where docid = ? and rev = ?)";
 			// delete all acl records for resources related to @aclid if any
 			pstmt = connection.prepareStatement(sql);
-			pstmt.setString(1, aclid);
+			pstmt.setString(1, docid);
+			pstmt.setInt(2, Integer.valueOf(revision));
 			// Increase DBConnection usage count
 			connection.increaseUsageCount(1);
 			logMetacat.debug("running sql: " + sql);
@@ -1829,10 +1793,18 @@
 			// handle ecogrid protocol
 			// get rid of revision number to get the docid.
 			String docid = DocumentUtil.getDocIdFromAccessionNumber(accessionNumber);
+			int rev = DocumentUtil.getRevisionFromAccessionNumber(accessionNumber);
+			String guid = null;
+			try {
+				guid = IdentifierManager.getInstance().getGUID(docid, rev);
+			} catch (McdbDocNotFoundException e1) {
+				guid = docid + "." + rev;
+				IdentifierManager.getInstance().createMapping(guid, guid);
+			}
 
 			currentDistributionSection
 					.setDistributionType(DistributionSection.DATA_DISTRIBUTION);
-			currentDistributionSection.setDataFileName(docid);
+			currentDistributionSection.setDataFileName(guid);
 
 			// distributionOnlineFileName = docid;
 			onlineDataFileIdInRelationVector.add(docid);
Index: src/edu/ucsb/nceas/metacat/IdentifierManager.java
===================================================================
--- src/edu/ucsb/nceas/metacat/IdentifierManager.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/IdentifierManager.java	(revision 6744)
@@ -1221,6 +1221,14 @@
      */
     private void insertAccessPolicy(String guid, AccessPolicy accessPolicy) throws McdbDocNotFoundException, AccessException {
     	
+    	// check for the existing permOrder so that we remain compatible with it (DataONE does not care)
+        XMLAccessAccess accessController  = new XMLAccessAccess();
+		String existingPermOrder = AccessControlInterface.ALLOWFIRST;
+        Vector<XMLAccessDAO> existingAccess = accessController.getXMLAccessForDoc(guid);
+        if (existingAccess != null && existingAccess.size() > 0) {
+        	existingPermOrder = existingAccess.get(0).getPermOrder();
+        }
+        
     	List<XMLAccessDAO> accessDAOs = new ArrayList<XMLAccessDAO>();
         for (AccessRule accessRule: accessPolicy.getAllowList()) {
         	List<Subject> subjects = accessRule.getSubjectList();
@@ -1230,20 +1238,24 @@
         		accessDAO.setPrincipalName(subject.getValue());
     			accessDAO.setGuid(guid);
     			accessDAO.setPermType(AccessControlInterface.ALLOW);
-    			accessDAO.setPermOrder(AccessControlInterface.ALLOWFIRST);
-    			for (Permission permission: permissions) {
-    				Long metacatPermission = new Long(convertPermission(permission));
-        			accessDAO.addPermission(metacatPermission);
+				accessDAO.setPermOrder(existingPermOrder);
+    			if (permissions != null) {
+	    			for (Permission permission: permissions) {
+	    				Long metacatPermission = new Long(convertPermission(permission));
+	        			accessDAO.addPermission(metacatPermission);
+	    			}
     			}
     			accessDAOs.add(accessDAO);
         	}
         }
         
-        // use GUID to update
-        XMLAccessAccess accessController  = new XMLAccessAccess(true);
-        accessController.replaceAccess(guid, accessDAOs);
         
+        // remove all existing allow records
+        accessController.deleteXMLAccessForDoc(guid, AccessControlInterface.ALLOW);
+        // add the ones we can for this guid
+        accessController.insertAccess(guid, accessDAOs);
         
+        
     }
     
     /**
@@ -1257,47 +1269,24 @@
         AccessPolicy accessPolicy = new AccessPolicy();
 
     	// use GUID to look up the access
-        XMLAccessAccess accessController  = new XMLAccessAccess(true);
+        XMLAccessAccess accessController  = new XMLAccessAccess();
         List<XMLAccessDAO> accessDAOs = accessController.getXMLAccessForDoc(guid);
         
         for (XMLAccessDAO accessDAO: accessDAOs) {
-        	AccessRule accessRule = new AccessRule();    	
-        	List <Permission> permissions = convertPermission(accessDAO.getPermission().intValue());
-        	accessRule.setPermissionList(permissions);
-        	Subject subject = new Subject();
-        	subject.setValue(accessDAO.getPrincipalName());
-        	accessRule.addSubject(subject);
-            accessPolicy.addAllow(accessRule);
+        	// only add allow rule
+        	if (accessDAO.getPermType().equals(AccessControlInterface.ALLOW)) {
+	        	AccessRule accessRule = new AccessRule();    	
+	        	List <Permission> permissions = convertPermission(accessDAO.getPermission().intValue());
+	        	accessRule.setPermissionList(permissions);
+	        	Subject subject = new Subject();
+	        	subject.setValue(accessDAO.getPrincipalName());
+	        	accessRule.addSubject(subject);
+	            accessPolicy.addAllow(accessRule);
+        	}
         }
         return accessPolicy;
     }
     
-    /**
-     * Lookup access policy from Metacat
-     * @param guid
-     * @return
-     * @throws McdbDocNotFoundException
-     * @throws AccessException
-     */
-    public AccessPolicy getAccessPolicyByLocalId(String docid) throws McdbDocNotFoundException, AccessException {
-        AccessPolicy accessPolicy = new AccessPolicy();
-
-    	// use GUID to look up the access
-        XMLAccessAccess accessController  = new XMLAccessAccess(false);
-        List<XMLAccessDAO> accessDAOs = accessController.getXMLAccessForDoc(docid);
-        
-        for (XMLAccessDAO accessDAO: accessDAOs) {
-        	AccessRule accessRule = new AccessRule();    	
-        	List <Permission> permissions = convertPermission(accessDAO.getPermission().intValue());
-        	accessRule.setPermissionList(permissions);
-        	Subject subject = new Subject();
-        	subject.setValue(accessDAO.getPrincipalName());
-        	accessRule.addSubject(subject);
-            accessPolicy.addAllow(accessRule);
-        }
-        return accessPolicy;
-    }
-    
     public int convertPermission(Permission permission) {
     	if (permission.equals(Permission.READ)) {
     		return AccessControlInterface.READ;
@@ -1312,26 +1301,26 @@
     }
     
     public List<Permission> convertPermission(int permission) {
+    	
     	List<Permission> permissions = new ArrayList<Permission>();
-    	if (permission == AccessControlInterface.READ) {
+    	if (permission == AccessControlInterface.ALL) {
     		permissions.add(Permission.READ);
-    		return permissions;
-    	}
-    	if (permission == AccessControlInterface.WRITE) {
     		permissions.add(Permission.WRITE);
+    		permissions.add(Permission.CHANGE_PERMISSION);
     		return permissions;
     	}
-    	if (permission == AccessControlInterface.CHMOD) {
+    	
+    	if ((permission & AccessControlInterface.CHMOD) == AccessControlInterface.CHMOD) {
     		permissions.add(Permission.CHANGE_PERMISSION);
-    		return permissions;
     	}
-    	if (permission == AccessControlInterface.ALL) {
+    	if ((permission & AccessControlInterface.READ) == AccessControlInterface.READ) {
     		permissions.add(Permission.READ);
+    	}
+    	if ((permission & AccessControlInterface.WRITE) == AccessControlInterface.WRITE) {
     		permissions.add(Permission.WRITE);
-    		permissions.add(Permission.CHANGE_PERMISSION);
-    		return permissions;
     	}
-		return null;
+    	
+		return permissions;
     }
     
     /**
@@ -1698,7 +1687,7 @@
             rows = stmt.executeUpdate();
             stmt.close();
             
-            // TODO: remove the xml_access?
+            // TODO: remove the access?
             // Metacat keeps "deleted" documents so we should not remove access rules.
             
         } catch (Exception e) {
Index: src/edu/ucsb/nceas/metacat/DocInfoHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocInfoHandler.java	(revision 6743)
+++ src/edu/ucsb/nceas/metacat/DocInfoHandler.java	(revision 6744)
@@ -50,7 +50,7 @@
 	private String _accessPermOrder;
 	private String _accessFileId;
 	private String _subTreeId;
-	private String _docId;
+	private String _guid;
 	private boolean _inPrincipal = false;
 	private boolean _inPermission = false;
 	private boolean _inAllow = false;
@@ -64,8 +64,8 @@
 	public DocInfoHandler() {
 	}
 
-	public DocInfoHandler(String docId) {
-		_docId = docId;
+	public DocInfoHandler(String guid) {
+		_guid = guid;
 	}
   
    /**
@@ -95,11 +95,10 @@
 			// new principal means new DAO for storing it
 			_inPrincipal = true;
 			_currentAccessDAO = new XMLAccessDAO();
-			_currentAccessDAO.setDocId(_docId);
+			_currentAccessDAO.setGuid(_guid);
 			_currentAccessDAO.setPermOrder(_accessPermOrder);
 			_currentAccessDAO.setAccessFileId(_accessFileId);
 			_currentAccessDAO.setSubTreeId(_subTreeId);
-			_currentAccessDAO.setDocId(_docId);
 			if (_inAllow) {
 				_currentAccessDAO.setPermType(AccessControlInterface.ALLOW);
 			}
