Hi. I am finished my application but have one last stumbling block. Its inside of AccessControl/Role.py in get_valid_userids() I have a object herirachy like: Zope Root -> MyApp -> Company -> Business Units in My App I have a PsycoPG connection object call my_users and in all Companies I have a exUserFolder. now when I goto a Company or Business Unit and try to assign/edit/list Local roles it bombs. Because exUserFolder cant find the 'my_users' connection object. Why? Well I know why.. because when the xxxLocalRoles screens are called they call get_valid_userids which at the top says: aclu = getattr(aq_base(item), 'acl_users', _notfound) and immediately aclu has all acquisition wrappers peeled off of it and now I can not go any further up the heirarchy than Company. I am very tempted in taking the aq_base(item) part off..and I believe all will work... But I really need someone who understands the implications of this to say whats the best way forward. I was thinking about overriding this method in my Company/Business Unit classes with a version that doesnt have aq_base(). I have no other acl_user folder objects except for in the root of the system. I could have one in My Application but its not necessary. thanks in advance, ~alan