i would like to do the same thing. i can hide windows but i don't see how to hide pages/tabs.
is this possible? if not, where should i look to potentially add this feature?
Look in the JSR-168 how to set security constraints on portal objects.
or look in the default portal descriptor files (default-object.xml), looking for "security-constraint" xml item.
but by example, you may not see all of it.
and the jboss portal ref doc.
for a page, visible or not, add a security-constraint item a the end of the page descriptor.