Ira Hochman writes:

Does anyone know how to set security on ZopeAttributionButton? I do not know how you can directly set permissions for ZopeAttributionButton.

But, as a wordaround, you can give "standard_html_footer" an appropriate proxy role. Dieter