Hi there, I have the impression (but I am unsure) that when a permission is granted to Anonymous, this permission is set for everybody. I gather this from the followin code: from AccessControl.User.py def allowed(self, object, object_roles=None): """Check whether the user has access to object. The user must have one of the roles in object_roles to allow access.""" if object_roles is _what_not_even_god_should_do: return 0 # Short-circuit the common case of anonymous access. if object_roles is None or 'Anonymous' in object_roles: return 1 ... Is this assumption correct ? Robert