If you haven’t already, take a look at this presentation … XI 3.0 Security for Mere Mortals. It specifically covers taking advantage of the new security features of XI 3.x.
Basically, you can keep your XIr2 model in place with XI 3.x. It will work pretty much the same. That said, you may want to consider implementing some of the new features of XI 3.x as an “investment” toward much easier maintenance.
Dwayne Hoffpauir 
(BOB member since 2002-09-19)