That did it! Thanks, all. (Out of curiosity, what's the reason for not making this the default? It seems to me that if you're making a role a child of another role, it's /because/ you want to inherit permissions. OTOH maybe defaulting to more security is smart enough to be worth the confusion...) -cb. > I think it's the other way around --- the login role needs the INHERIT property. Anyway, one or the other should do it. regards, tom lane No virus found in this incoming message. Checked by AVG. Version: 7.5.526 / Virus Database: 270.4.3/1528 - Release Date: 7/1/2008 7:26 AM No virus found in this outgoing message. Checked by AVG. Version: 7.5.526 / Virus Database: 270.4.3/1528 - Release Date: 7/1/2008 7:26 AM