I'm trying to wrap my mind around what you call workgroups. By the way, have you reviewed the use cases for workgroups that I put in http://www.zope.org/Members/nuxeo/Products/NuxUserGroups/README.txt ? Lennart Regebro <lennart@torped.se> wrote: [...]
With normal grouping, you typically have one group per department, and give that department access to a couple of parts of the database. Then you have a group of the Bosses that have more access. But usually this means that all the Bosses have Boss access everywhere, which is not necessarily what you want.
No no no ! With NUG the Roles added to a group are still added at the local role level, which means that the 'bosses' group only has a Boss role where you want it. Besides in the current NUG I don't yet have a way to assign a global Role to a group (this can be added later anyway, the current model is all that we needed, and the implementation is flexible enough to permit it later). I really think that my model can be used for what you do.
So, even if it is very tempting to let Florent implement the local roles blacklist instead of doing it ourselves :-), I'd rather wait for workgroups than standard groups. In any case Johan and me would be very happy to help Florent and the others at Nuxeo implement it groups and blacklists.
Thanks. But I insist that "my" groups are nearly the same as "your" workgroups. Florent -- Florent Guillaume, Nuxeo (Paris, France) +33 1 40 33 79 10 http://nuxeo.com mailto:fg@nuxeo.com