I wish to restrict the creation of a class (SpokeSite) to people with the "Add Spoke Site" permission, and in turn only provide that permission to people in the 'Super-manager' Role.

When I call ProductContext.registerClass for my SpokeSite class, I can pass the permission argument with the tuple ('Add Spoke Site', 'Super-manager'), which does a good job of limiting the availability of my class (just as I desire).

However, I would like my Product to automatically create the 'Super-manager' Role, if it doesn't exists. The bad part is that this role needs to be added before any of my objects exist, which makes it hard...

I've got it *working* by cheating, and using the private __app attribute of the ProductContext. Is there a better way for python Products to alter the Zope installation (add Roles, create Folders, etc.) during installation?

Thanks!

-Randy