I just analysed why "AccessControl.Role.RoleManager.get_valid_userids" raised an unexpected "AttributeError". It uses the wrong idiom to access optional attribute: aclu = getattr(aq_base(item), '__allow_groups__', _notfound) This means, that "aclu" is only partially acquisition wrapped and does not behave as usual. Until Tim reported that "hasattr" behaves bad with respect to exceptions, I have been convinved, that the following idiom were correct: if hasattr(aq_base(obj), attrname): attr = getattr(obj, attrname) ... Meanwhile, the best way to access optional attributes seems to be if getattr(aq_base(obj), attrname, notFound) is not notFound: attr = getattr(obj, attrname) ... Please keep this in mind when you push the "Death to 'hasattr'" project. -- Dieter