Since I'm not good at explaining how I think Zopes groups and roles should work, I have decided to show you instead: The patch is availible at http://www.zope.org/Members/regebro/workgroups/ . Just zip it up in the Products directory and restart. I won't be held responsible for anything even if it definitely is my fault. :-) This is a "proof of concept" implementation. It's availiable as a "monkeypatch" that should work on both 2.4 and 2.5 and maybe even 2.3 and 2.2. The user interface is ugly, and the code is uglier, but who cares. This is a fast hack to show how I think it should work instead of trying to explain it. :-) So, please: Check this out and say what you think. I think this a definite improvement. Another definite improvement should be switching the permissions and local roles pages. The roles should pop up first, and the permissions page could be access from that one. Best Regards Lennart Regebro Torped Strategi och Kommunikation AB