(Yes, i have read 5.1 in The UnenlightnedZopiestas Guide to exuserfolder) i have Root Folder / j2 / acl_users (an exuser folder) Root Folder / j2 / docLogin Root Folder / j2 / docLogout Root Folder / j2 / site (all permission are set to acquire) Root Folder / j2 / site / protect (permissions set so that only the role permtest has view access) I add users to my acl_users, and set permtest on one user. Now, loging on to /j2/site/protect with a user that DOESNT have permtest, i just get the "logon" again. Thats fair enogh. BUT if i do it with a user that HAS permission, Zope pops up a login pop box, and i cant get on, since it seems to point to an upstream user folder. What am i missing? I have placed the folder to protect a level under the acl_user folder. So, now what?