Am 26.08.2005 um 11:12 schrieb Roel Wuyts: It's possible in the current implementation without extension. The key is to give permissions only to the structures, not to the users. When a user tries to access a structure, the permissions are taken from the structure. I think the following should work for you: - anonymous user: -- role 'anon' (no permissions) - registered user -- role 'editor' (no permissions) - root folder '/' -- role 'anon' (allow read) -- role 'editor (allow read and write) - folder '/private/' -- role 'anon' (no permissions) I'm not 100% sure if you can indeed "take away" permissions in the subfolder, you need to try that. We employ an even finer-grained scheme with write access for different users in different folders. For that, we give each folder a separate role with write permissions (the role is named after the folder). When a user should be allowed to write in that folder, it is assigned a role with the folder name (but again without permissions). - Bert -

After talking with a colleague it appears that you can indeed not "take away" permissions in a subfolder, all permissions are inherited.

Indeed, in every structure you are able to redefine (override) the roles: Just add a new role with the same name but different permissions to your structure and from there on in the tree those permissions will be used. As an example have a look at the following tree where the anonymous-role is initially defined in the root but redefined (overridden) in two of its sub folders: Root-Folder (anonymous: #( view edit )) Read/Write-Subwiki Readonly-Subwiki (anonymous: #( view ) Private-Subwiki (anonymous: #( ))