diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java
index edca117..b55f18f 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionCleanupFilter.java
@@ -10,7 +10,7 @@
  * @author hanl
  * @date 28/07/2015
  */
-public class CollectionCleanupFilter extends RewriteQuery {
+public class CollectionCleanupFilter extends RewriteTask.RewriteQuery {
 
     // track path to operand
     @Deprecated
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
index a4cf771..1ceb1e3 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/CollectionConstraint.java
@@ -1,20 +1,28 @@
 package de.ids_mannheim.korap.resource.rewrite;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import de.ids_mannheim.korap.user.User;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.resources.Corpus;
+import de.ids_mannheim.korap.resources.KustvaktResource;
+import de.ids_mannheim.korap.security.ac.SecurityManager;
 
 /**
  * @author hanl
  * @date 03/07/2015
  */
-public class CollectionConstraint extends RewriteNode {
+// todo: test
+public class CollectionConstraint extends RewriteTask.RewriteNode {
+
+    public CollectionConstraint() {
+        super();
+    }
 
     @Override
     public JsonNode rewrite(KoralNode koralnode) {
         JsonNode node = koralnode.rawNode();
         if (node.at("/@type").asText().equals("koral:doc")) {
-            if (node.at("/key").asText().equals("corpusID") && !check(node,
-                    koralnode.getUser())) {
+            if (node.at("/key").asText().equals("corpusID") && !check(
+                    koralnode)) {
                 koralnode.removeNode();
                 // todo: add message that node was removed!
             }
@@ -22,8 +30,20 @@
         return node;
     }
 
-    private boolean check(JsonNode node, User user) {
-        return false;
+    private boolean check(KoralNode node) {
+        if (!node.hasUser())
+            return true;
+
+        String id = node.rawNode().at("/value").asText();
+        KustvaktResource corpus;
+        try {
+            SecurityManager m = SecurityManager
+                    .findbyId(id, node.getUser(), Corpus.class);
+            corpus = m.getResource();
+        }catch (KustvaktException e) {
+            return false;
+        }
+        return corpus != null;
     }
 
 }
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java
index 58e3ff2..b166181 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/FoundryInject.java
@@ -4,15 +4,17 @@
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.resource.LayerMapper;
 
+
 /**
  * @author hanl
  * @date 30/06/2015
  */
-public class FoundryInject extends RewriteNode {
+public class FoundryInject extends RewriteTask.RewriteNode {
 
     private KustvaktConfiguration config;
 
     public FoundryInject(KustvaktConfiguration config) {
+        super();
         this.config = config;
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java
index e708504..64365e1 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/KoralNode.java
@@ -45,6 +45,11 @@
         };
     }
 
+    public static KoralNode getNode(JsonNode node, User user) {
+        return new KoralNode(node, user) {
+        };
+    }
+
     public void set(String name, Object value) {
 
         if (this.node.isObject()) {
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/MetaConstraint.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/MetaConstraint.java
index 4660235..af7d998 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/MetaConstraint.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/MetaConstraint.java
@@ -6,7 +6,7 @@
  * @author hanl
  * @date 04/07/2015
  */
-public class MetaConstraint extends RewriteQuery {
+public class MetaConstraint extends RewriteTask.RewriteQuery {
 
     public MetaConstraint() {
         super();
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
index d6685ea..88ce41e 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/PublicCollection.java
@@ -1,20 +1,42 @@
 package de.ids_mannheim.korap.resource.rewrite;
 
 import com.fasterxml.jackson.databind.JsonNode;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.resources.Corpus;
+import de.ids_mannheim.korap.security.ac.ResourceFinder;
+import de.ids_mannheim.korap.utils.CollectionQueryBuilder3;
+
+import java.util.Set;
 
 /**
  * @author hanl
  * @date 04/07/2015
  */
-public class PublicCollection extends RewriteQuery {
+public class PublicCollection extends RewriteTask.RewriteQuery {
 
+    // todo: where to inject the array node into? --> super group with and relation plus subgroup with ids and or operation
     @Override
     public JsonNode rewrite(KoralNode node) {
         JsonNode subnode = node.rawNode();
         if (!subnode.at("/collection").findValuesAsText("key")
                 .contains("corpusID")) {
             //todo: inject public collection node
+            if (node.hasUser()) {
+                try {
+                    ResourceFinder finder = ResourceFinder
+                            .init(node.getUser(), Corpus.class);
+                    Set<String> ids = finder.getIds();
+                    createNode(ids);
+                }catch (KustvaktException e) {
+                    e.printStackTrace();
+                }
+            }
         }
         return subnode;
     }
+
+    private JsonNode createNode(Set<String> ids) {
+        JsonNode node = CollectionQueryBuilder3.Utils.buildDocGroup();
+        return node;
+    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
index 5676817..6c613ca 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteHandler.java
@@ -18,8 +18,8 @@
 public class RewriteHandler {
 
     private static Logger jlog = KustvaktLogger.initiate(RewriteHandler.class);
-    private Collection<RewriteNode> node_processors;
-    private Collection<RewriteQuery> query_processors;
+    private Collection<RewriteTask.RewriteNode> node_processors;
+    private Collection<RewriteTask.RewriteQuery> query_processors;
 
     public RewriteHandler() {
         this.node_processors = new HashSet<>();
@@ -27,11 +27,11 @@
         // add defaults?!
     }
 
-    public void add(RewriteNode node) {
+    public void add(RewriteTask.RewriteNode node) {
         this.node_processors.add(node);
     }
 
-    public void add(RewriteQuery node) {
+    public void add(RewriteTask.RewriteQuery node) {
         this.query_processors.add(node);
     }
 
@@ -73,10 +73,12 @@
 
     private static boolean processNode(JsonNode node, User user,
             Collection<? extends RewriteTask> tasks) {
-        KoralNode knode = KoralNode.getNode(node);
+        KoralNode knode = KoralNode.getNode(node, user);
         for (RewriteTask task : tasks) {
-            jlog.debug("running node in processor " + node);
-            jlog.debug("on processor " + task.getClass().toString());
+            if (jlog.isDebugEnabled()) {
+                jlog.debug("running node in processor " + node);
+                jlog.debug("on processor " + task.getClass().toString());
+            }
             task.rewrite(knode);
             if (knode.toRemove())
                 break;
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java
index ed5ad34..4b44c42 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/RewriteTask.java
@@ -10,8 +10,41 @@
 @Getter
 public abstract class RewriteTask {
 
-    protected RewriteTask() {
+    private RewriteTask() {
     }
 
     public abstract JsonNode rewrite(KoralNode node);
+
+
+    /**
+     * query rewrites get injected the entire query from root containing all child nodes
+     * <p/>
+     * {@link de.ids_mannheim.korap.resource.rewrite.RewriteTask.RewriteQuery} does not allow the deletion of the root node or subnode through KoralNode.
+     * The {@link de.ids_mannheim.korap.resource.rewrite.RewriteHandler} will igonore respecitve invalid requests
+     *
+     * @author hanl
+     * @date 03/07/2015
+     */
+    public static abstract class RewriteQuery extends RewriteTask {
+        public RewriteQuery() {
+            super();
+        }
+    }
+
+
+
+    /**
+     * node rewrites get injected typically object nodes that are subject to altering.
+     * Be aware that node rewrites are processed before query rewrites. Thus query rewrite may override previous node rewrites
+     *
+     * {@link de.ids_mannheim.korap.resource.rewrite.RewriteTask.RewriteNode} rewrite support the deletion of the respective node by simply setting the node invalid in KoralNode
+     *
+     * @author hanl
+     * @date 03/07/2015
+     */
+    public static abstract class RewriteNode extends RewriteTask {
+        public RewriteNode() {
+            super();
+        }
+    }
 }
diff --git a/src/main/java/de/ids_mannheim/korap/resource/rewrite/TreeConstraint.java b/src/main/java/de/ids_mannheim/korap/resource/rewrite/TreeConstraint.java
index e285114..0bde30f 100644
--- a/src/main/java/de/ids_mannheim/korap/resource/rewrite/TreeConstraint.java
+++ b/src/main/java/de/ids_mannheim/korap/resource/rewrite/TreeConstraint.java
@@ -40,7 +40,7 @@
  * @author hanl
  * @date 02/07/2015
  */
-public class TreeConstraint extends RewriteQuery {
+public class TreeConstraint extends RewriteTask.RewriteQuery {
 
     private String pointer;