Hello, I have 13000+ users validation records in a database, so I thought I would be clever. I define a pier user, role-dbuser, and use this as a template for creating a "User whose validation is certified by the database" on the fly. Since it is created on the fly and is not known by PRKernel-users, nor is the User-Groups relation maintained, so the groups are only aware of the template user 'role-dbuser'. This works fine until the check on groups permissions in PUSecurity-validateCommand: which reads; (self group notNil and: [ (self group includes: aCommand context user) So I turned it around to read the following, and implemented PUUser includesGroup: (self group notNil and: [ (aCommand context user includesGroup: self group) I thought that you might consider this tweak useful. best regards Keith