[Zope-dev] Only anonymous in an Access Rule?

Hi, How come getSecurityManager().getUser() returns the Anonymous User in access rules? Surely some checks must have been done to see whether the folder containing the access rule can be traversed to? If so, then why is the anonymous user still being returned? If not, then huh? I'm confused :-( Chris