Hi all, I have the following problem. In my system, there are authors and viewers. The Authors create articles and can edit them, the viewers only view them. To this rule there is one exception, Viewers can post comments on the articles. These comments are actually coded in the properties of the articles. Giving the Author role permissions on changing the articles and the properties of the articles and the viewers only permission to view the articles gets you quite far. Then I was planning on using proxy roles to help the Viewers comment the articles. One script, PostComment, has a proxy role Author. Now, this works fine, as long as PostComment only calls Zope defined methods. If PostComment calls any method I wrote for my own z-classes and that method calls manage_changeProperties() for example, a security exceptions is thrown. Is this the way it is supposed to be? Why doesn't my z-class defined method inherite the proxy role from PostComment and in what way do the Zope definied methods differ from this pattern? Any help is appreciated. Douwe