I actually kind of dig the security model with XI. Call me crazy. I do believe it is more than a few steps up from the days of 6.5 and older. I know it has its shortcomings but it is getting better.
One challenge I’ve dealt with a few times is delegated administration. The goal is in putting user administration in a corporate information security group’s hands rather than a Business Objects Admin’s hands. This makes perfect sense in a deployment that didn’t necessarily start on a Windows AD or LDAP deployment or relies heavily Enterprise groups for access control.