Hi All, I'm in the middle of changing the security handling on the Guestbook product I submitted to the site not too long ago. I now have a situation where I have a product (Guestbook), which adds and manages sub-objects (GuestBookEntry). The permission 'Add Entry', instead of being a permission of the enclosing folder, is now a permission associated with the Guestbook. In the manage screen, a newly-created product instance has the 'Acquire' box set, but doesn't have the 'Add Entry' permission granted to any roles ('Anonymous' or 'Manager'). When the acquire box is ticked, I can add entries in a fresh browser without having to enter any authentication info, even with no roles granted the appropriate permission, so it seems as if the 'Add Entry' permission is being acquired from somewhere, even tho no-one further up the chain has this permission to acquire. If I deselect the 'Acquire' box, I'm now get the authentication dialogue when I try to add entries, and I have to grant the 'add entry' permission to diferent roles if I want them to add entries. (i.e. this is the behaviour I was kind of expecting when the acquire box was checked!). Cheers, Andy.