by the way i may be wrong on that part of the username policy appears to apply to sigs but not all of it the signature policy appears to have been enforced in several different ways but not obviously including uaa i will post a query later on bongomatic