I know I've seen this question asked before, but I couldn't find it (is there a better way to search the mailing list archives than the one on the mailing list index page?). I've got a ZClass, and I'm trying to set things up so that a certain set of authenticated users have permission to add new instances of the class and to edit just those instances they have created. I assume that the latter will automatically be possible since they will be owner of the object created. But I can't even get the add to work, despite following the ZClass documentation on setting up permissions. My test user who has the "Add..." permission gets an 'authorization failed' when I try to add an instance. So I'd like to see exactly where the permission check is failing. How do I get Zope to tell me what permission it was looking for when the permission check failed? I also don't understand what the define permissions screen on the product containing the ZClass does; the current Content Manager's Manual's coverage of it is very sparse and uniformitive. I tried mapping "Add..." to "Add..." there, but that didn't help any. And another oddity while I'm here; the role that is given "Add" permission for my class does *not* have Add permission for anything else, yet when a user with only that role goes to the management screen for the folder he is presented with *three* add choices, the other two being "Add ZGadfly Database Connection" and "Add ZPyGreSQL Database Connection". Is this maybe a clue? FYI I'm running this under 2.1.2, with most of the stuff having been created under 2.0.1. --RDM