ok, i edited my permissions for A and allowed only View. i logged into B (closed and reopened browser!) and see the same permissions -- everything but Special and Admin. so it definitely isn't reading permissions from A. would it help if i posted my auth.pl code?