XML Security

[Matt]

I have posted this on ASP security to no avail. I have a web app written in
c#. This app dynamically creates an Xsl doc from user defined info in the
database. It also creates an instance of another c# class. This object gets
passed into the Xsl doc as a parameter, and it is called from within the
stylesheet to perform various functions during transformation. This object
also uses some gdi32 and other unmanaged code. The I am seeing is that
various exceptions (SecurityException, namely) are thrown from the component
any time these methods are called. I have tried granting FullTrust to each
zone and this does not have any effect. The only way I can get this code to
run correctly is to grant FullTrust to "All_Code". This is, of course, not
an option in production, and I am wondering:
1) How can I get this to work without the huge security hole
2) Under what zone/context should this code be operating once inside the
stylesheet?
3) Why can "All_Code" have an effect when "LocalIntranet_Zone",
MyComputer_Zone and the others are irrelevant in this case?