Hi, Is the following possible? I want to create a new role :Small_Manager This descends from the Manager role, but has some things disabled. That is instead of creating each roles seperately, make it possible to let them descend from one. And then lowering their permissions. This makes it easy when I disallow a certain permission on top of the tree. All descendants will lose the permission too. I tried to mimic this in the following test : Root Folder : user tom : Manager in a sub-folder : user tito: Manager, but nothing acquired from above instead the view management screen. Now, when I enter as tito, it is still possible to make changes to the documents in the sub-folder... while I explecitely said that the manager role in the sub-folder was only able to view the management screen, not to make changes... what am I doing wrong? ps. Yes, I closed all my browsers, before logging in as tito. Tom.