Tom Deprez writes:

The Acq_perm column doesn't exists. Assume that acquisition of a permission is always Active. The checkboxes of the role show their actual value (according to the acquisition). Thus if permissionA is checked in the parent-object, permissionA is also checked. If you want, for a certain role that this permission is not given, you uncheck permissionA. The subobject will show an unchecked permissionA box (because it acquires from its parent). In order to give the subobject again the permission, we only have to check permissionA.

I do not like the proposal. I want to have some information, when permissions change automatically if something changes further up in the tree (that is what the "Acq_perm" tells). I would, however, like it, if the permissions had 3 values: * inherit setting further up determines whether the permission is granted or denied * explicitly grant permission granted independent of setting further up * explicitly denied permission denied independent of setting further up Dieter