diff --git a/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/caveat/RMConstraintInfo.java b/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/caveat/RMConstraintInfo.java
index 2df4cf5c34..c5f68475ae 100644
--- a/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/caveat/RMConstraintInfo.java
+++ b/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/caveat/RMConstraintInfo.java
@@ -21,12 +21,12 @@ package org.alfresco.module.org_alfresco_module_rm.caveat;
 import java.util.Arrays;
 
 public class RMConstraintInfo
-{    
+{
     private String name;
     private String title;
     private boolean caseSensitive;
     private String[] allowedValues;
-    
+
     public void setName(String name)
     {
         this.name = name;
@@ -53,13 +53,13 @@ public class RMConstraintInfo
     }
     public void setAllowedValues(String[] values)
     {
-        this.allowedValues = values;
+        this.allowedValues = values.clone();
     }
     public String[] getAllowedValues()
     {
         return allowedValues;
     }
-    
+
     @Override
     public String toString()
     {
@@ -75,5 +75,5 @@ public class RMConstraintInfo
         builder.append("]");
         return builder.toString();
     }
-    
+
 }
diff --git a/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/jscript/ScriptCapability.java b/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/jscript/ScriptCapability.java
index 1192084b80..de79832559 100644
--- a/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/jscript/ScriptCapability.java
+++ b/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/jscript/ScriptCapability.java
@@ -26,7 +26,7 @@ public class ScriptCapability
     private String name;
     private String displayLabel;
     private String[] actions;
-    
+
     /**
      * @param name
      * @param displayLabel
@@ -36,7 +36,7 @@ public class ScriptCapability
     {
         this.name = name;
         this.displayLabel = displayLabel;
-        this.actions = actions;
+        this.actions = actions.clone();
     }
 
     /**
@@ -46,7 +46,7 @@ public class ScriptCapability
     {
         return name;
     }
-    
+
     /**
      * @return the displayLabel
      */
@@ -54,7 +54,7 @@ public class ScriptCapability
     {
         return displayLabel;
     }
-    
+
     /**
      * @return the actions
      */
diff --git a/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/script/slingshot/RMSearchPropertiesGet.java b/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/script/slingshot/RMSearchPropertiesGet.java
index 1bc72fc980..55761d8d57 100644
--- a/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/script/slingshot/RMSearchPropertiesGet.java
+++ b/rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/script/slingshot/RMSearchPropertiesGet.java
@@ -83,7 +83,7 @@ public class RMSearchPropertiesGet extends DeclarativeWebScript
     {
         this.namespaceService = namespaceService;
     }
-    
+
     /**
      * @param filePlanService   file plan service
      */
@@ -101,7 +101,7 @@ public class RMSearchPropertiesGet extends DeclarativeWebScript
         Map<String, Object> model = new HashMap<String, Object>(13);
 
         List<Group> groups = new ArrayList<Group>(5);
-        
+
         // get the file plan
         // TODO the file plan should be passed to this web script
         NodeRef filePlan = filePlanService.getFilePlanBySiteId(FilePlanService.DEFAULT_RM_SITE_ID);
@@ -121,7 +121,7 @@ public class RMSearchPropertiesGet extends DeclarativeWebScript
             }
 
             AspectDefinition aspectDefinition = dictionaryService.getAspect(aspect);
-            Group group = new Group(aspect.getLocalName(), aspectDefinition.getTitle(dictionaryService), propObjs);    
+            Group group = new Group(aspect.getLocalName(), aspectDefinition.getTitle(dictionaryService), propObjs);
             groups.add(group);
         }
 
@@ -152,7 +152,7 @@ public class RMSearchPropertiesGet extends DeclarativeWebScript
         {
             this.id = id;
             this.label = label;
-            this.properties = properties;
+            this.properties = properties.clone();
         }
 
         public String getId()