Yeah.  Let's certainly not implement any membership calculations in XSLT, please. :)  I certainly agree this JSP-tag-like construct is better than that.  I'm suggesting it might be even better to have the configurable-by-this-user-ness already computed by the time the attribute is stapled into the XML so that the XSLT doesn't have to call `upAuth:hasPermission` and can rely on the attribute being the fully digested boolean of whether this user should be invited to configure this object.  Analogous to the dlm: attribute around user ability to delete a node.