Well, I'm at a loss. I tried a bunch things myself, and I've found out that instances of the Article class are not inheriting __ac_permissions__ from the Posting class. In fact, even if you override __ac_permissions__ in the Article class, the validate() method is reporting there's nothing there. What I don't understand is, SquishSite works, and SquishFile works, what's so different about the Posting/Article classes? I thought all one had to do was inherit RoleManager, and set everything properly in __ac_permissions__ ? Or am I totally not getting the 2.2 Security model? Do you know what's going on here?
Did you run the Article class through Globals.default__class_init__()? E.g. (at the module level), e.g.: Globals.default__class_init__(Article)