diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataStoreServer.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataStoreServer.java
index 4460cb1e4afda8ae6253612b09c99f356c599052..5e0ba9043b8764c443844b4a4608111804e9b5c1 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataStoreServer.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataStoreServer.java
@@ -59,6 +59,7 @@ import ch.systemsx.cisd.openbis.dss.generic.server.ConfigParameters.PluginServle
 import ch.systemsx.cisd.openbis.dss.generic.server.api.v1.DssServiceRpcGeneric;
 import ch.systemsx.cisd.openbis.dss.generic.shared.IEncapsulatedOpenBISService;
 import ch.systemsx.cisd.openbis.dss.generic.shared.ServiceProvider;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IDssServiceRpcGenericInternal;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.DataStoreApiUrlUtilities;
 import ch.systemsx.cisd.openbis.dss.generic.shared.utils.DssPropertyParametersUtil;
 import ch.systemsx.cisd.openbis.generic.shared.IServer;
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcAuthorizationAdvisor.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcAuthorizationAdvisor.java
index f183acec8a564a92b79242f84faddbd386cd99b1..dc99cbe01e1b64f8a8a27f5b1d90a8b711fcd9a9 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcAuthorizationAdvisor.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcAuthorizationAdvisor.java
@@ -76,17 +76,17 @@ public class DssServiceRpcAuthorizationAdvisor extends DefaultPointcutAdvisor
      * 
      * @param methodInterceptor
      */
-    DssServiceRpcAuthorizationAdvisor(MethodInterceptor methodInterceptor)
+    public DssServiceRpcAuthorizationAdvisor(MethodInterceptor methodInterceptor)
     {
         super(new AnnotationMatchingPointcut(null, DataSetAccessGuard.class), methodInterceptor);
     }
 
     /**
-     * Package visible class for verifying authorization.
+     * Class for verifying authorization. Made public so it can be extended in tests.
      * 
      * @author Chandrasekhar Ramakrishnan
      */
-    static class DssServiceRpcAuthorizationMethodInterceptor implements MethodInterceptor
+    public static class DssServiceRpcAuthorizationMethodInterceptor implements MethodInterceptor
     {
         /**
          * Get the session token and any guarded parameters and invoke the guards on those
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/api/v1/DssServiceRpcGeneric.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/api/v1/DssServiceRpcGeneric.java
index f82007a7c9363c41860963d451e03d06e481a5c1..4a15b239513a4113e000e2295c2d85d85c63eeb1 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/api/v1/DssServiceRpcGeneric.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/api/v1/DssServiceRpcGeneric.java
@@ -25,8 +25,8 @@ import java.util.ArrayList;
 import ch.systemsx.cisd.base.exceptions.IOExceptionUnchecked;
 import ch.systemsx.cisd.etlserver.api.v1.PutDataSetService;
 import ch.systemsx.cisd.openbis.dss.generic.server.AbstractDssServiceRpc;
-import ch.systemsx.cisd.openbis.dss.generic.server.IDssServiceRpcGenericInternal;
 import ch.systemsx.cisd.openbis.dss.generic.shared.IEncapsulatedOpenBISService;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IDssServiceRpcGenericInternal;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.DataSetFileDTO;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.FileInfoDssBuilder;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.FileInfoDssDTO;
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataSetCodeStringPredicate.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/DataSetCodeStringPredicate.java
similarity index 90%
rename from datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataSetCodeStringPredicate.java
rename to datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/DataSetCodeStringPredicate.java
index d93a912ad216f5c9dc3edef177ccb39d54e8bc7b..3906b6c795eb479028d83a4e869b6ca29f3b9bb1 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataSetCodeStringPredicate.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/DataSetCodeStringPredicate.java
@@ -14,11 +14,10 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.dss.generic.server;
+package ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization;
 
 import ch.systemsx.cisd.common.exceptions.Status;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
-import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IAuthorizationGuardPredicate;
 
 /**
  * Predicate for checking that the current user has access to a data set specified by code.
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataSetFileDTOPredicate.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/DataSetFileDTOPredicate.java
similarity index 91%
rename from datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataSetFileDTOPredicate.java
rename to datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/DataSetFileDTOPredicate.java
index 494639b2bd9da77e31d278c65f2a1f95520c9893..3317fc860f55c07d87c13fa88e1b0411a71c9ac4 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/DataSetFileDTOPredicate.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/DataSetFileDTOPredicate.java
@@ -14,11 +14,10 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.dss.generic.server;
+package ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization;
 
 import ch.systemsx.cisd.common.exceptions.Status;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
-import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IAuthorizationGuardPredicate;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.DataSetFileDTO;
 
 /**
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IAuthorizationGuardPredicate.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IAuthorizationGuardPredicate.java
index 8a8fc37c0749a5c26c0f26b6c6c9e4d5af28e092..b31739a7812ff43bc08a47956e9072a50709a734 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IAuthorizationGuardPredicate.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IAuthorizationGuardPredicate.java
@@ -21,10 +21,22 @@ import ch.systemsx.cisd.common.exceptions.UserFailureException;
 
 /**
  * Interface for objects that can function as guardClasses in an AuthorizationGuard.
+ * <p>
+ * Predicates should return Status.OK if the user is authorized for the action; they should return a
+ * status with an appropriate error message if the user is not authorized.
  * 
  * @author Chandrasekhar Ramakrishnan
  */
 public interface IAuthorizationGuardPredicate<T /* Receiver */, D /* Argument */>
 {
+
+    /**
+     * Evaluate the predicate for the receiver object, sessionToken, and predicate argument.
+     * 
+     * @param receiver The object on which the guarded method was called
+     * @param sessionToken A token identifying the user
+     * @param argument The argument to the predicate
+     * @return Status.OK if the action is allowed, Status.createError(<a message>) otherwise.
+     */
     public Status evaluate(T receiver, String sessionToken, D argument) throws UserFailureException;
 }
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/IDssServiceRpcGenericInternal.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IDssServiceRpcGenericInternal.java
similarity index 91%
rename from datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/IDssServiceRpcGenericInternal.java
rename to datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IDssServiceRpcGenericInternal.java
index 4c261c5c3620011cd17a84d51105cb083ffc9654..c84a710d73ec060f9093c46193a3befad4925049 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/IDssServiceRpcGenericInternal.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/IDssServiceRpcGenericInternal.java
@@ -14,10 +14,11 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.dss.generic.server;
+package ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization;
 
 import java.io.File;
 
+import ch.systemsx.cisd.openbis.dss.generic.server.DataStoreServer;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.IDssServiceRpcGeneric;
 import ch.systemsx.cisd.openbis.generic.shared.dto.identifier.SpaceIdentifier;
 
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/NewDataSetPredicate.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/NewDataSetPredicate.java
similarity index 96%
rename from datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/NewDataSetPredicate.java
rename to datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/NewDataSetPredicate.java
index 20e64f4025d886dfa73e10bd041a1008a690e4a2..977ed3cd686b71398ec20918266dfc5d45891667 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/server/NewDataSetPredicate.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/authorization/NewDataSetPredicate.java
@@ -14,11 +14,10 @@
  * limitations under the License.
  */
 
-package ch.systemsx.cisd.openbis.dss.generic.server;
+package ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization;
 
 import ch.systemsx.cisd.common.exceptions.Status;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
-import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IAuthorizationGuardPredicate;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.NewDataSetDTO;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.NewDataSetDTO.DataSetOwner;
 import ch.systemsx.cisd.openbis.generic.shared.dto.identifier.ExperimentIdentifier;
diff --git a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/v1/IDssServiceRpcGeneric.java b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/v1/IDssServiceRpcGeneric.java
index d6769be89314f431010de4567082ed8a24ced157..7976c9bf308d937b6726ed181d31fa16e7ecc074 100644
--- a/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/v1/IDssServiceRpcGeneric.java
+++ b/datastore_server/source/java/ch/systemsx/cisd/openbis/dss/generic/shared/api/v1/IDssServiceRpcGeneric.java
@@ -20,11 +20,11 @@ import java.io.InputStream;
 
 import ch.systemsx.cisd.base.exceptions.IOExceptionUnchecked;
 import ch.systemsx.cisd.common.api.IRpcService;
-import ch.systemsx.cisd.openbis.dss.generic.server.DataSetCodeStringPredicate;
-import ch.systemsx.cisd.openbis.dss.generic.server.DataSetFileDTOPredicate;
-import ch.systemsx.cisd.openbis.dss.generic.server.NewDataSetPredicate;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.AuthorizationGuard;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.DataSetAccessGuard;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.DataSetCodeStringPredicate;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.DataSetFileDTOPredicate;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.NewDataSetPredicate;
 
 /**
  * Generic functionality for interacting with the DSS.
diff --git a/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/client/api/v1/impl/DssComponentTest.java b/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/client/api/v1/impl/DssComponentTest.java
index 835039f3a5e9eb1da8a2d2f97f0d10ab75986d24..b0a95c7523c8d8f643e949e7ab8a82c19e719473 100644
--- a/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/client/api/v1/impl/DssComponentTest.java
+++ b/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/client/api/v1/impl/DssComponentTest.java
@@ -46,9 +46,9 @@ import ch.systemsx.cisd.common.exceptions.EnvironmentFailureException;
 import ch.systemsx.cisd.openbis.dss.client.api.v1.IDataSetDss;
 import ch.systemsx.cisd.openbis.dss.generic.server.AbstractDssServiceRpc;
 import ch.systemsx.cisd.openbis.dss.generic.server.DssServiceRpcAuthorizationAdvisor;
-import ch.systemsx.cisd.openbis.dss.generic.server.IDssServiceRpcGenericInternal;
 import ch.systemsx.cisd.openbis.dss.generic.server.api.v1.DssServiceRpcGeneric;
 import ch.systemsx.cisd.openbis.dss.generic.shared.IEncapsulatedOpenBISService;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IDssServiceRpcGenericInternal;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.DataSetFileDTO;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.DataStoreApiUrlUtilities;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.FileInfoDssBuilder;
diff --git a/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcV1Test.java b/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcV1Test.java
index 56ecc3ec1706d90886ff2313279911a5ff112ddc..79e1ad71fe882d845e1a19563590b1cac3fbcf45 100644
--- a/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcV1Test.java
+++ b/datastore_server/sourceTest/java/ch/systemsx/cisd/openbis/dss/generic/server/DssServiceRpcV1Test.java
@@ -57,6 +57,7 @@ import ch.systemsx.cisd.etlserver.validation.IDataSetValidator;
 import ch.systemsx.cisd.openbis.dss.generic.server.DssServiceRpcAuthorizationAdvisor.DssServiceRpcAuthorizationMethodInterceptor;
 import ch.systemsx.cisd.openbis.dss.generic.server.api.v1.DssServiceRpcGeneric;
 import ch.systemsx.cisd.openbis.dss.generic.shared.IEncapsulatedOpenBISService;
+import ch.systemsx.cisd.openbis.dss.generic.shared.api.authorization.IDssServiceRpcGenericInternal;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.DataSetFileDTO;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.FileInfoDssBuilder;
 import ch.systemsx.cisd.openbis.dss.generic.shared.api.v1.FileInfoDssDTO;
@@ -499,7 +500,7 @@ public class DssServiceRpcV1Test extends AbstractFileSystemTestCase
     private static class TestMethodInterceptor extends DssServiceRpcAuthorizationMethodInterceptor
             implements MethodInterceptor
     {
-        boolean methodInvoked = false;
+        private boolean methodInvoked = false;
 
         @Override
         public Object invoke(MethodInvocation methodInvocation) throws Throwable