CMFCore.PortalContent has: def _verifyActionPermissions(self, action): pp = action.get('permissions', ()) if not pp: return 1 sm = getSecurityManager() for p in pp: if _checkPermission(p, self): return 1 return 0 Here we do nothing with sm... any intended effect ? Thanks, Florent Guillaume Nuxeo