Imagine a Zope-hosting ISP with a single ZODB. A user Daz signs up for webhosting and sends in his custom products and Zope tree. The ISP installs said data as follows: root Control_Panel Products dazProduct dazClass1 dazClass2 acl_users (user daz with Manager role) subroot (daz's Zope tree) acl_users (user daz with Manager role) index_html The site works fine. The problem is that daz is unable to create new instances of his classes - the add methods lack the permission to call manage_editProperties. In contrast, "superuser" *is* able to add instances. I can get around this problem my giving the constructors the proxy role of Manager, but I'd really like to understand why this is happening. Any info is much appreciated. Cheers, Darran.