diff --git a/browser/common.py b/browser/common.py
index 056073b..50001b1 100644
--- a/browser/common.py
+++ b/browser/common.py
@@ -56,6 +56,7 @@ from cybertools.stateful.interfaces import IStateful
 from cybertools.text import mimetypes
 from cybertools.typology.interfaces import IType, ITypeManager
 from loops.common import adapted
+from loops.config.base import DummyOptions
 from loops.i18n.browser import I18NView
 from loops.interfaces import IResource, IView, INode
 from loops.organize.tracking import access
@@ -114,13 +115,9 @@ class BaseView(GenericView, I18NView):
         super(BaseView, self).__init__(context, request)
         # TODO: get rid of removeSecurityProxy() call - not yet...
         self.context = removeSecurityProxy(context)
-        #self.context = context
-        #self.setSkin(self.loopsRoot.skinName)
-        #self.checkLanguage()
         try:
             if not canAccessObject(context):
-                raise Unauthorized
-                #request.response.redirect('login.html')
+                raise Unauthorized('%r: title' % (context))
         except ForbiddenAttribute:  # ignore when testing
             pass
 
@@ -393,8 +390,7 @@ class BaseView(GenericView, I18NView):
 
     @Lazy
     def options(self):
-        #return IOptions(self.context)
-        return IOptions(self.adapted)
+        return component.queryAdapter(self.adapted, IOptions) or DummyOptions()
 
     @Lazy
     def globalOptions(self):
diff --git a/browser/configure.zcml b/browser/configure.zcml
index c36e68c..61e9645 100644
--- a/browser/configure.zcml
+++ b/browser/configure.zcml
@@ -111,14 +111,13 @@
       title="loops Container"
       description="A top-level loops container"
       permission="zope.ManageContent"
-      view="AddLoopsContainer.html"
-      />
+      view="AddLoopsContainer.html" />
 
   <containerViews
       for="loops.interfaces.ILoops"
-      contents="zope.ManageContent"
-      add="zope.ManageContent"
-      />
+      index="zope.View"
+      contents="loops.ManageSite"
+      add="loops.ManageSite" />
 
   <page
       name="edit.html"
@@ -136,13 +135,13 @@
       schema="loops.interfaces.IConceptManager"
       content_factory="loops.concept.ConceptManager"
       template="add.pt"
-      permission="zope.ManageContent"
-      />
+      permission="zope.ManageContent" />
 
   <containerViews
       for="loops.interfaces.IConceptManager"
-      add="zope.ManageContent"
-      />
+      index="loops.ManageSite"
+      contents="loops.ManageSite"
+      add="loops.ManageSite" />
 
   <!-- concept -->
 
@@ -243,8 +242,9 @@
 
   <containerViews
       for="loops.interfaces.IResourceManager"
-      add="zope.ManageContent"
-      />
+      index="loops.ManageSite"
+      contents="loops.ManageSite"
+      add="loops.ManageSite" />
 
   <!-- resource in general -->
 
@@ -354,55 +354,44 @@
       schema="loops.interfaces.IViewManager"
       content_factory="loops.view.ViewManager"
       template="add.pt"
-      permission="zope.ManageContent"
-      />
+      permission="zope.ManageContent" />
 
   <containerViews
       for="loops.interfaces.IViewManager"
-      index="zope.ManageContent"
-      add="zope.ManageContent"
-      />
+      index="zope.View"
+      add="zope.ManageContent" />
 
   <menuItem
       for="loops.interfaces.IViewManager"
       action="contents.html"
       permission="zope.ManageContent"
-      menu="zmi_views" title="Contents"
-      />
+      menu="zmi_views" title="Contents" />
 
   <!-- record manager -->
 
   <containerViews
       for="loops.interfaces.IRecordManager"
-      index="zope.ManageContent"
-      />
+      index="loops.ManageSite"
+      add="loops.ManageSite" />
 
   <menuItem
       for="loops.interfaces.IRecordManager"
       action="contents.html"
-      permission="zope.ManageContent"
-      menu="zmi_views" title="Contents"
-      />
+      permission="loops.ManageSite"
+      menu="zmi_views" title="Contents" />
 
   <!-- node -->
 
   <icon
       name="zmi_icon"
       for="loops.interfaces.INode"
-      file="node_icon.gif"
-      />
+      file="node_icon.gif" />
 
   <menuItem
       for="loops.interfaces.INode"
-      action="@@contents.html"
+      action="contents.html"
       permission="zope.ManageContent"
-      menu="zmi_views" title="Contents"
-      />
-
-  <!--<containerViews
-      for="loops.interfaces.INode"
-      index="zope.ManageContent"
-      />-->
+      menu="zmi_views" title="Contents" />
 
   <addform
       label="Add Node"
@@ -412,10 +401,8 @@
       fields="title description nodeType viewName body"
       template="add.pt"
       permission="zope.ManageContent">
-
     <widget field="description" height="2" />
     <widget field="body" height="8" />
-
   </addform>
 
   <addMenuItem
@@ -423,8 +410,7 @@
       title="Node"
       description="A node provides access to concepts, possibly hierarchically organized"
       permission="zope.ManageContent"
-      view="AddLoopsNode.html"
-      />
+      view="AddLoopsNode.html" />
 
   <editform
       label="Edit Node"
diff --git a/browser/loops.css b/browser/loops.css
index f147e90..9021d6d 100644
--- a/browser/loops.css
+++ b/browser/loops.css
@@ -64,10 +64,11 @@ table.listing {
 table.listing th {
     font-family: Verdana, Tahoma, Arial, Helvetica, sans-serif;
     color: #000040;
+    padding: 0 2px 0 2px;
 }
 
 table.listing td {
-    padding: 0 1px 0 1px;
+    padding: 0 2px 0 2px;
     white-space: normal;
     vertical-align: middle;
 }
diff --git a/browser/node.py b/browser/node.py
index aa8a19e..09c7d50 100644
--- a/browser/node.py
+++ b/browser/node.py
@@ -503,8 +503,10 @@ class NodeView(BaseView):
 
     @Lazy
     def workItems(self):
-        return component.getMultiAdapter((self.context, self.request),
-                                         name='workitems.html')
+        target = self.virtualTargetObject
+        if target is not None:
+            return component.getMultiAdapter((target, self.request),
+                                             name='taskworkitems.html')
 
     # comments
 
diff --git a/concept.py b/concept.py
index 4bf3ab6..31aeb94 100644
--- a/concept.py
+++ b/concept.py
@@ -1,5 +1,5 @@
 #
-#  Copyright (c) 2008 Helmut Merz helmutm@cy55.de
+#  Copyright (c) 2009 Helmut Merz helmutm@cy55.de
 #
 #  This program is free software; you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -120,7 +120,7 @@ class Concept(Contained, Persistent):
         typePred = self.getConceptManager().getTypePredicate()
         if typePred is None:
             return None
-        parents = self.getParents([typePred])
+        parents = self.getParents([typePred], noSecurityCheck=True)
         # TODO (?): check for multiple types (->Error)
         return parents and parents[0] or None
     def setConceptType(self, concept):
diff --git a/config/base.py b/config/base.py
index 70ca94a..1010b8d 100644
--- a/config/base.py
+++ b/config/base.py
@@ -73,7 +73,8 @@ class LoopsOptions(Options):
 
     def parseContextOptions(self):
         def result():
-            for opt in  self.context.options:
+            options = getattr(self.context, 'options', [])
+            for opt in  options:
                 parts = opt.split(':', 1)
                 key = parts[0].strip()
                 if len(parts) == 1:
@@ -94,3 +95,8 @@ class QueryOptions(LoopsOptions):
 
     adapts(IQueryConcept)
 
+
+class DummyOptions(Options):
+
+    def __getitem__(self, key):
+        return []
diff --git a/configure.zcml b/configure.zcml
index fb088c1..1511a81 100644
--- a/configure.zcml
+++ b/configure.zcml
@@ -183,9 +183,6 @@
     <require
         permission="zope.ManageContent"
         set_schema=".interfaces.INode" />
-    <!--<require
-        permission="zope.View"
-        interface="zope.app.container.interfaces.IReadContainer" />-->
   </class>
 
   <!-- record manager -->
diff --git a/locales/de/LC_MESSAGES/loops.mo b/locales/de/LC_MESSAGES/loops.mo
index 2d9b225..b296121 100644
Binary files a/locales/de/LC_MESSAGES/loops.mo and b/locales/de/LC_MESSAGES/loops.mo differ
diff --git a/locales/de/LC_MESSAGES/loops.po b/locales/de/LC_MESSAGES/loops.po
index 4049f2b..4d424a8 100644
--- a/locales/de/LC_MESSAGES/loops.po
+++ b/locales/de/LC_MESSAGES/loops.po
@@ -3,7 +3,7 @@ msgstr ""
 
 "Project-Id-Version: $Id$\n"
 "POT-Creation-Date: 2007-05-22 12:00 CET\n"
-"PO-Revision-Date: 2008-12-15 12:00 CET\n"
+"PO-Revision-Date: 2009-01-26 12:00 CET\n"
 "Last-Translator: Helmut Merz <helmutm@cy55.de>\n"
 "Language-Team: loops developers <helmutm@cy55.de>\n"
 "MIME-Version: 1.0\n"
@@ -478,3 +478,18 @@ msgstr "Zielobjekt zuordnen"
 msgid "Search Term"
 msgstr "Suchbegriff"
 
+msgid "Day"
+msgstr "Tag"
+
+msgid "Start"
+msgstr "Beginn"
+
+msgid "End"
+msgstr "Ende"
+
+msgid "Duration"
+msgstr "Dauer"
+
+msgid "Effort"
+msgstr "Aufwand"
+
diff --git a/resource.py b/resource.py
index 0cfe549..6ab2838 100644
--- a/resource.py
+++ b/resource.py
@@ -1,5 +1,5 @@
 #
-#  Copyright (c) 2008 Helmut Merz helmutm@cy55.de
+#  Copyright (c) 2009 Helmut Merz helmutm@cy55.de
 #
 #  This program is free software; you can redistribute it and/or modify
 #  it under the terms of the GNU General Public License as published by
@@ -114,7 +114,7 @@ class Resource(Image, Contained):
         typePred = cm.getTypePredicate()
         if typePred is None:
             return None
-        concepts = self.getConcepts([typePred])
+        concepts = self.getConcepts([typePred], noSecurityCheck=True)
         # TODO (?): check for multiple types (->Error)
         return concepts and concepts[0] or cm.get('file', None)
     def setResourceType(self, concept):
diff --git a/security.zcml b/security.zcml
index 000a95e..c53c138 100644
--- a/security.zcml
+++ b/security.zcml
@@ -15,26 +15,43 @@
       id="loops.ManageSite"
       title="[loops-manage-site-permission] loops: Manage Site" />
 
+  <permission
+      id="loops.ManageTypes"
+      title="[loops-manage-types-permission] loops: Manage Types" />
+
+  <permission
+      id="loops.ManageWorkspaces"
+      title="[loops-manage-workspaces-permission] loops: Manage Workspaces" />
+
   <permission
       id="loops.ViewRestricted"
       title="[loops-view-restricted-permission] loops: View Restricted Information" />
 
+  <permission
+      id="loops.EditRestricted"
+      title="[loops-edit-restricted-permission] loops: Edit Restricted Information" />
+
   <!-- roles and default permissions for roles -->
 
   <role id="loops.SiteManager"
         title="[loops-manage-site-role] loops: Site Manager" />
   <grant role="loops.SiteManager" permission="loops.ManageSite" />
+  <grant role="loops.SiteManager" permission="loops.ManageTypes" />
+  <grant role="loops.SiteManager" permission="loops.ManageWorkspaces" />
   <grant role="loops.SiteManager" permission="loops.xmlrpc.ManageConcepts" />
   <grant role="loops.SiteManager" permission="zope.ManageContent" />
   <grant role="loops.SiteManager" permission="zope.View" />
 
   <role id="loops.Staff"
         title="[loops-staff-role] loops: Staff" />
+  <grant role="loops.Staff" permission="loops.ManageWorkspaces" />
+  <grant role="loops.Staff" permission="loops.EditRestricted" />
   <grant role="loops.Staff" permission="zope.ManageContent" />
   <grant role="loops.Staff" permission="zope.View" />
 
   <role id="loops.Master"
         title="[loops-master-role] loops: Master" />
+  <grant role="loops.Master" permission="zope.ManageContent" />
 
   <role id="loops.xmlrpc.ConceptManager"
         title="[xmlrpc-manage-concepts-role] loops: Concept Manager (XML-RPC)" />