Re: I seek overall advice.

[rob@xxxxxxxxx]

Others have replied quite well.  I just want to add this.
WRKSYSVAL QSECURITY.
No point in worrying about the users having *ALLOBJ until you are at level 
30 or higher.
Do not take away *ALLOBJ from a user until you create a second profile for 
yourself that does not have *ALLOBJ.  Test the application with the user 
profile without *ALLOBJ before you ram it on the users.  Got a lot of 
programmers here that have *ALLOBJ on the development machine.  Telling a 
user "Gee, it worked for me" goes over as well as telling the same line to 
your wife.

Rob Berendt