Hello everybody Maybe the answer is easy, but I can not find the solution:(and maybe I was completly wrong about permissions) I have a folder containing SQLs and methods: /project and a subfolder who has his access and view security setting disable for anonymous: /project/protected When anonymous access /project/index_html he see the page : that's good. 1)When anonymous access /project/protected/index_html he also see the page. Is it normal?? ( the index_html is of course only inside the /project ) 2)If anonymous access /project/protected/some_method_with_sql and the result is empty, he see the result page!That's strange. But if the result is not empty, he get the authentication box : that's good. It's zope2.2.1 So can someone explain me the rules when an unprotected object is acquired from a protected folder?? Thanks, Gilles