Hello, how can I implement a hierarchical group schema by using roles like this? comp/deptA/subdeptA /deptB/subdeptB /subdeptC ... for authentication I want to check if someone has a role corresponding to the name of a containing folder, i.e. editing should be allowed in subdeptC when someone has either the subdeptC, the deptB or the comp role. now I understand that it is a different thing to have a folder object called "deptB" and a role "deptB" - how can I iterate over the parent folders and check against each role? if I try this I get an error (trace below ..): <dtml-in PARENTS> <dtml-let item=sequence-item> <dtml-if item> .<dtml-var "item.id">. <dtml-if "AUTHENTICATED_USER.has_role(item.id,this())"> X </dtml-if> <br> </dtml-if> </dtml-let> </dtml-in> The error message is: Error Type: TypeError Error Value: loop over non-sequence ... File /home/oliver/Zope/lib/python/DocumentTemplate/DT_Let.py, line 145, in render (Object: item=sequence-item) File /home/oliver/Zope/lib/python/DocumentTemplate/DT_Util.py, line 321, in eval (Object: AUTHENTICATED_USER.has_role(item.id,this())) File <string>, line 0, in ? File /home/oliver/Zope/lib/pyt now the output (omitting the "AUTHENTICATED_USER..." line) shows me that among the sequence-items there is one object called <Python Method object ...> How can I check against this object without using regex or something like that? Another question is how to clone an existing role into a new one with just a different ID.. thanks for your help oliver