[Zope] Debugging permission errors: min permissions to add ZClass instance.

[R. David Murray]

I know I've seen this question asked before, but I couldn't find
it (is there a better way to search the mailing list archives than
the one on the mailing list index page?).

I've got a ZClass, and I'm trying to set things up so that a certain
set of authenticated users have permission to add new instances of
the class and to edit just those instances they have created.  I
assume that the latter will automatically be possible since they
will be owner of the object created.  But I can't even get the add
to work, despite following the ZClass documentation on setting up
permissions.  My test user who has the "Add..." permission gets
an 'authorization failed' when I try to add an instance.

So I'd like to see exactly where the permission check is failing.
How do I get Zope to tell me what permission it was looking for
when the permission check failed? 

I also don't understand what the define permissions screen on
the product containing the ZClass does; the current Content
Manager's Manual's coverage of it is very sparse and uniformitive.
I tried mapping "Add..." to "Add..." there, but that didn't help any.

And another oddity while I'm here; the role that is given "Add"
permission for my class does *not* have Add permission for anything
else, yet when a user with only that role goes to the management
screen for the folder he is presented with *three* add choices,
the other two being "Add ZGadfly Database Connection" and "Add
ZPyGreSQL Database Connection".  Is this maybe a clue?

FYI I'm running this under 2.1.2, with most of the stuff having
been created under 2.0.1.

--RDM