would only allow *.nz access to anything in /local and everyone else
would be refused.
I ask, because it is a simple step to go from this to
kdomain /www/sensitive/budget/* budget
kdomain /www/sensitive/staff/* staff
to define kerberos demesne for files in various locations and do away
entirely with the hostname gumpf.
Nat.