[Zope-dev] Reason for Uathorization Failure

How does one determine the reason that authorization is denied to a particular resource? Is the fact of denial logged anywhere? I am trying to set up two local roles for some projected sections of a website. I would like to create a UserAdministrator local role who can add, delete, or modify user passwords, and a Browser role, who must log in, but may not do anything but view. I am having trouble getting the permissions right for this scenario. Any hints? Thanks. Jim Penny