Which version ? 2.6 CR 1 ?
What security message do you have.
On your snippet you give all rights, so the tab for this should be displayed.
Shouldn't the tab only be displayed if the user has the MyRole role?
i have things set to hide so when the user clicks on the tab the page content is hidden.
Not if anything at the upper level grants recursive view right.
For example at the portal level (that's the default behavior).
i changed jboss-portal.sar\conf\data\default-object.xml and now the tabs are restricted.