I created an ASP web-page where users can enter their vacation-rules. The user logs in with LDAP authentication and then can start creating vacation-rules. They can enter a rulename, reply-text and enter all kinds of exceptions just like you can do in the GroupWise client. (Like don't reply to certain email-addresses or domains, only reply to internal and/or external email etc.). When they hit the 'save' button, this data is then stored in a SQL-database. I also wrote a back-end application which (through Trusted Application) regularly checks all new email of all users and then (according to the personal rules in the database) generates a reply to the original sender of the email.
When such a reply is generated, the original email can (optionally) be moved to a specific GroupWise folder in the users' mailbox. In addition to this, in the back-en application, exceptions can also be put in. For example, you can enter a company-wide rule that addresses like hotmail.com, yahoo.com etc. will NEVER get a vacation-reply. Also, the maximum replies per addressee per day can be set to a certain maximum. (Default is 3).

The end-result in case, is that all (3000 or so) users can create vacation-rules and that the security manager is happy because his users cannot auto-forward confidential information.