Dave,
We ran into a similar issue in developing a custom porlet to mitigate content based upon account and origin.
The portlet would simply read a table or series of tables into a portlet and display a set of columns. The challenge was trying to keep consistency between tables, but still put an emphasis on security.
What we found as a solution was the use of the acegi-security-1.0.1.jar found in /probes/service/wasp/webapps/jasperserver-pro/WEB-INF/classes. This jar is more commonly used for the practice of creating multi-tentative reports within Unified Reporter.
Once we were able to get around this particular issue, we discovered a new issue while testing. Flash will actually cache the session in /home/<username>/.macromedia/Flash_Player/ (Linux) for each individual object within flex. In the case of a Liferay, it was simply placing the objects in memory or in the cache of the local machine and reusing them to save resources. Therefore, each time a user accesses the portal, regardless of account/origin, it will use the cache of the local machine. However, this should only be a per user basis.
As for the alarm console porlet specifically, this does cache to the local machine in AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ on a windows system.
For other porlets (list views) it must use some other form of caching feature.
I will let you know if we figure it out.
Thank You,
Jeff Young
IntelliNet Corporation