I think Phillip has made a very clear distinction between roles and groups: roles are local, groups are not. It also makes sense to map groups to local roles. I'll leave the concerns regarding the implementation and UI to the others at Zope... --Guido van Rossum (home page: http://www.python.org/~guido/)