In typical on demand grid computing scenarios, services from different organisations can potentially run in the same Web service engine on a single grid node, making intra-engine service security vital for any production system. In this paper, a solution to the problem of intra-engine inter-service security for ad hoc grid environments based on WSRF is presented. To ensure that only authorized access to grid services is possible from within other services' code, a dynamic group enabled sandboxing approach within Apache Axis is proposed to protect dynamically deployed grid services. It relies on the features provided by a hot deployment service developed for ad hoc grids. A prototypical implementation of the hot deployment service and the intra-engine service security approach based on the Globus Toolkit 4 (GT4) is used to demonstrate the feasibility of our approach.