diff --git a/bin/interactive.py b/bin/interactive.py
index 0fcce7dc..6c56807f 100644
--- a/bin/interactive.py
+++ b/bin/interactive.py
@@ -5,8 +5,9 @@
 import os
 import time
 import numpy as np
+import time
 import contextlib
-
+import time
 import logging
 logging.basicConfig(
     level=logging.INFO,
diff --git a/odmf/__init__.py b/odmf/__init__.py
index 3484529c..9e6c2a72 100644
--- a/odmf/__init__.py
+++ b/odmf/__init__.py
@@ -1,2 +1,2 @@
-__version__ = '2023.11.09'
+__version__ = '2023.12.13.dev2'
 prefix = '.'
diff --git a/odmf/db/base.py b/odmf/db/base.py
index 88af0ff1..ef68d17a 100644
--- a/odmf/db/base.py
+++ b/odmf/db/base.py
@@ -137,13 +137,17 @@ class ObjectGetter:
     >>> print(ds[10])
     >>> ds.q.filter_by(measured_by='philipp')
     """
-    def __init__(self, cls: type, session: orm.Session):
+    def __init__(self, cls: type, session: orm.Session, **filter):
         self.cls = cls
         self.session = session
+        self.filter = filter
+
+    def __repr__(self):
+        return f'db.{self.cls.__name__}[...]'
 
     @property
     def q(self) -> orm.Query:
-        return self.session.query(self.cls)
+        return self.session.query(self.cls).filter_by(**self.filter)
 
     def __getitem__(self, item):
         return self.q.get(item)
@@ -151,5 +155,8 @@ def __getitem__(self, item):
     def __repr__(self):
         return 'ObjectGetter(' + self.cls.__name__ + ')'
 
+    def __iter__(self):
+        return iter(self.q)
+
 
 
diff --git a/odmf/db/dataset.py b/odmf/db/dataset.py
index 1ba87a4f..336783bf 100644
--- a/odmf/db/dataset.py
+++ b/odmf/db/dataset.py
@@ -13,8 +13,10 @@
 
 from .base import Base, session_scope
 from ..config import conf
+from ..webpage import auth
 from typing import Optional
 from logging import getLogger
+
 logger = getLogger(__name__)
 
 tzberlin = pytz.timezone('Europe/Berlin')
@@ -131,6 +133,13 @@ class Dataset(Base):
     _source = sql.Column("source", sql.Integer, sql.ForeignKey(
         'datasource.id'), nullable=True)
     source = orm.relationship("Datasource", backref="datasets")
+    access = sql.Column(sql.Integer, default=1, nullable=False)
+    timezone = sql.Column(sql.String,
+                          default=conf.datetime_default_timezone)
+    _project = sql.Column('project', sql.Integer, sql.ForeignKey('project.id'),
+                         nullable=True)
+    project = sql.orm.relationship('Project', back_populates='datasets')
+
     calibration_offset = sql.Column(sql.Float, nullable=False, default=0.0)
     calibration_slope = sql.Column(sql.Float, nullable=False, default=1.0)
     comment = sql.Column(sql.String)
@@ -140,12 +149,8 @@ class Dataset(Base):
     uses_dst = sql.Column(sql.Boolean, default=False, nullable=False)
     __mapper_args__ = dict(polymorphic_identity=None,
                            polymorphic_on=type)
-    access = sql.Column(sql.Integer, default=1, nullable=False)
 
-    timezone = sql.Column(sql.String,
-                          default=conf.datetime_default_timezone)
-    project = sql.Column(sql.Integer, sql.ForeignKey('project.id'),
-                         nullable=True)
+
 
     def __str__(self):
         site = self.site.id if self.site else ''
@@ -240,17 +245,17 @@ def path(self):
 
     @classmethod
     def filter(
-            cls, session, 
-            valuetype: Optional[int]=None, 
+            cls, session,
+            valuetype: Optional[int]=None,
             user: Optional[str]=None,
-            site: Optional[int]=None, 
-            date: Optional[datetime.datetime]=None, 
+            site: Optional[int]=None,
+            date: Optional[datetime.datetime]=None,
             instrument: Optional[int]=None,
-            type: Optional[str]=None, 
+            type: Optional[str]=None,
             level: Optional[float]=None
     ) -> orm.Query:
         """
-        Filters datasets for fitting properties 
+        Filters datasets for fitting properties
         """
         datasets: orm.Query = session.query(cls)
         if user:
@@ -272,6 +277,31 @@ def filter(
             datasets = datasets.filter_by(level=level)
         return datasets
 
+    def get_access_level(self, user: auth.User) -> auth.Level:
+        """
+        Returns the access level of a user for this dataset, depending on the users access level,
+        if the datasets project is a project of the user or if the user is the owner.
+
+        Site admins, the owner (measured_by) and admins of this datasets project are admins for the dataset.
+        Lower levels are defined by the project. If the dataset does not belong to a project, the access level to
+        the dataset is the access level of the user
+
+        :param user:
+        :return:
+        """
+        if user.level >= auth.Level.admin:
+            return user.level
+        elif user.name == self.measured_by.username:
+            return auth.Level.admin
+        elif self._project is None:
+            return user.level
+        elif self._project in user.projects:
+            return user.projects[self._project]
+        else:
+            return auth.Level.guest
+
+    def is_defined(self) -> bool:
+        return bool(self.measured_by and self.site and self.valuetype)
 
 def removedataset(*args):
     """Removes a dataset and its records entirely from the database
diff --git a/odmf/db/person.py b/odmf/db/person.py
index f694166f..b2313fe2 100644
--- a/odmf/db/person.py
+++ b/odmf/db/person.py
@@ -1,3 +1,5 @@
+import typing
+
 import sqlalchemy as sql
 import sqlalchemy.orm as orm
 from functools import total_ordering
@@ -49,3 +51,27 @@ def __lt__(self, other):
                 return NotImplemented
             return self.surname < str(other)
         return self.surname < other.surname
+
+    def projects(self):
+        """
+        Yields Project, access_level tuples
+        :return:
+        """
+        from .project import ProjectMember, Project
+        from ..webpage.auth import Level
+        pm: ProjectMember
+        for pm in (
+                self.session().query(ProjectMember)
+                    .filter(ProjectMember.member == self)
+                    .order_by(ProjectMember.access_level.desc(), ProjectMember._member)
+        ):
+            yield pm.project, Level(pm.access_level)
+        for project in self.session().query(Project).filter(Project.person_responsible == self):
+            yield project, Level.admin
+
+
+    def add_project(self, project, access_level: int=0):
+        from .project import ProjectMember
+        pm = ProjectMember(member=self, project=project, access_level=access_level)
+        self.session().add(pm)
+        return pm
diff --git a/odmf/db/project.py b/odmf/db/project.py
index 966df0ac..5c0adb10 100644
--- a/odmf/db/project.py
+++ b/odmf/db/project.py
@@ -1,7 +1,7 @@
 import sqlalchemy as sql
 import sqlalchemy.orm as orm
 from .base import Base
-
+from .person import Person
 from functools import total_ordering
 
 from logging import getLogger
@@ -15,7 +15,7 @@ class Project(Base):
     """
     __tablename__ = 'project'
 
-    id = sql.Column(sql.Integer, primary_key=True)
+    id = sql.Column(sql.Integer, primary_key=True, autoincrement=True)
     _person_responsible = sql.Column('person_responsible', sql.String,
                                      sql.ForeignKey('person.username'))
     person_responsible = sql.orm.relationship(
@@ -25,10 +25,79 @@ class Project(Base):
     )
     name = sql.Column(sql.String)
     comment = sql.Column(sql.String)
+    sourcelink = sql.Column(sql.String)
+    organization = sql.Column(sql.String, default='uni-giessen.de')
+    datasets = sql.orm.relationship('Dataset')
+
+    @property
+    def members_query(self):
+        """Returns a query object with all ProjectMember object related to this project"""
+        return self.session().query(ProjectMember).filter(ProjectMember._project==self.id)
+    def members(self, access_level=0):
+        from ..webpage.auth import Level
+        for pm in (
+                self.members_query.filter(ProjectMember.access_level>=access_level)
+                        .order_by(ProjectMember.access_level.desc(), ProjectMember._member)
+        ):
+            yield pm.member, Level(pm.access_level)
+
+        if self.person_responsible:
+            yield self.person_responsible, Level.admin
+
+    def add_member(self, person: Person|str, access_level: int=0):
+        from ..webpage.auth import Level
+        if not type(person) is Person:
+            person = Person.get(self.session(), person)
+        if person.access_level < Level.editor and access_level >= Level.editor:
+            raise ValueError(f'Cannot give {person} who is not a global editor editing rights for a project')
+        if pm:=self[person]:
+            pm.access_level = access_level
+        else:
+            pm = ProjectMember(member=person, project=self, access_level=access_level)
+            self.session().add(pm)
+        return pm
+
+    def remove_member(self, username: Person|str):
+        if type(username) is Person:
+            username = username.username
+        n=self.members_query.filter_by(_member=username).delete()
+        if not n:
+            raise ValueError(f'{username} was not a member of {self}, cannot remove')
+
+    def __getitem__(self, username):
+        if type(username) is Person:
+            username = username.username
+        return self.members_query.filter_by(_member=username).first()
+
+
+    def get_access_level(self, user: Person|str):
+        """
+        Returns the level a given user has in context of this project
+
+        Site admins and project spokepersons evaluate as Level.admin, every other project member
+        with their level as saved in the members list (Level.logger...Level.admin). Users who are not
+        members of the project and not site admins evaluate as Level.guest
+
+        :param user: A db.Person object or a username
+        :return: the Level
+        """
+        from ..webpage.auth import Level
+        if not type(user) is Person:
+            user = Person.get(self.session(), user)
+
+        if user == self.person_responsible:
+            return Level.admin
+        elif user.access_level >= Level.admin:
+            return Level(user.access_level)
+        for member, level in self.members():
+            if member == user:
+                return Level(level)
+        else:
+            return Level.guest
+
 
     def __str__(self):
-        return " %s %s: %s %s" % (self.id, self.name, self.person_responsible,
-                                  self.comment)
+        return self.name
 
     def __repr__(self):
         return "<Project(id=%s, name=%s, person=%s)>" % \
@@ -50,6 +119,20 @@ def __jdict__(self):
                     person_responsible=self.person_responsible,
                     comment=self.comment)
 
-# Creating all tables those inherit Base
-# print "Create Tables"
-# Base.metadata.create_all(engine)
+
+class ProjectMember(Base):
+    """
+    n:n Association object between projects and their members.
+
+    TODO: Write tests
+    """
+    __tablename__ = 'project_member'
+
+    _project = sql.Column('project', sql.ForeignKey('project.id', ondelete='CASCADE'), primary_key=True)
+    _member = sql.Column('member', sql.ForeignKey('person.username', ondelete='CASCADE'), primary_key=True)
+
+    project = sql.orm.relationship('Project')
+    member = sql.orm.relationship('Person')
+
+    access_level = sql.Column(sql.Integer, nullable=False, default=0)
+
diff --git a/odmf/db/site.py b/odmf/db/site.py
index 4fff74d3..f8a0cd64 100644
--- a/odmf/db/site.py
+++ b/odmf/db/site.py
@@ -54,6 +54,19 @@ def __jdict__(self):
                     comment=self.comment,
                     icon=self.icon)
 
+    def __eq__(self, other):
+        if hasattr(other, 'id'):
+            return NotImplemented
+        return self.id == other.id
+
+    def __lt__(self, other):
+        if not hasattr(other, 'id'):
+            return NotImplemented
+        return self.id < other.id
+
+    def __hash__(self):
+        return hash(str(self))
+
     def as_UTM(self):
         """Returns a tuple (x,y) as UTM/WGS84 of the site position
         If withzone is True it returns the name of the UTM zone as a third argument
@@ -66,6 +79,33 @@ def as_coordinatetext(self):
         return ("%i° %i' %0.2f''N - " % lat) + ("%i° %i' %0.2f''E" % lon)
 
 
+@total_ordering
+class SiteGeometry(Base):
+    """
+    Enhance a site with Geometry features, like line or polygon
+    TODO: sqlalchemy: Do we need polymorphic_identity
+    TODO: Implement __geo_interface__ for Site and GeometrySite
+
+    Uses GeoJSON definition to save the geometry of a site
+    https://de.wikipedia.org/wiki/GeoJSON
+    """
+    __tablename__ = 'site_geometry'
+
+    id = sql.Column(sql.Integer, sql.ForeignKey('site.id'), primary_key=True)
+    site = orm.relationship('Site', backref=orm.backref('geometry'),
+                            primaryjoin="Site.id==SiteGeometry.id")
+    type = sql.Column(sql.Text)  # Contains the GeoJSON geometry type: POINT, POLYGON, MULTILINESTRING etc.
+    coordinates = sql.Column(sql.Text)  # Contains coordinates in GeoJSON notation
+
+    strokewidth = sql.Column(sql.Float)
+    strokeopacity = sql.Column(sql.Float)
+    strokecolor = sql.Column(sql.Text)
+    fillcolor = sql.Column(sql.Text)
+    fillopacity = sql.Column(sql.Float)
+
+
+
+
 @total_ordering
 class Datasource(Base):
     __tablename__ = 'datasource'
@@ -85,6 +125,11 @@ def linkname(self):
     def __str__(self):
         return '%s (%s)' % (self.name, self.sourcetype)
 
+    def __eq__(self, other):
+        if not hasattr(other, 'name'):
+            return NotImplemented
+        return self.name == other.name
+
     def __lt__(self, other):
         if not hasattr(other, 'name'):
             return NotImplemented
@@ -92,6 +137,9 @@ def __lt__(self, other):
             return self.name < other.name
         return False
 
+    def __hash__(self):
+        return hash(str(self))
+
     def __jdict__(self):
         return dict(id=self.id,
                     name=self.name,
diff --git a/odmf/db/sql/migration/2023-11-project-authorization.sql b/odmf/db/sql/migration/2023-11-project-authorization.sql
new file mode 100644
index 00000000..91cc983d
--- /dev/null
+++ b/odmf/db/sql/migration/2023-11-project-authorization.sql
@@ -0,0 +1,2 @@
+alter table project add column organization varchar default 'uni-giessen.de';
+alter table project add column sourcelink varchar;
\ No newline at end of file
diff --git a/odmf/db/timeseries.py b/odmf/db/timeseries.py
index 500dda61..0888b039 100644
--- a/odmf/db/timeseries.py
+++ b/odmf/db/timeseries.py
@@ -220,7 +220,14 @@ def addrecord(self, Id=None, value=None, time=None, comment=None, sample=None, o
         if (not self.valuetype.inrange(value)):
             raise ValueError(f'RECORD does not fit VALUETYPE: {value:g} {self.valuetype.unit} is out of '
                              f'range for {self.valuetype.name}')
-        if not (self.start <= time <= self.end or out_of_timescope_ok):
+
+        # Check and adjust the timescope of the dataset
+        if out_of_timescope_ok or None in (self.start, self.end):
+
+            self.start = min(self.start or time, time)
+            self.end = max(self.end or time, time)
+
+        elif not(self.start <= time <= self.end):
             raise ValueError(
                 f'RECORD does not fit DATASET: You tried to insert a record for date {time} '
                 f'to dataset {self}, which allows only records between {self.start} and {self.end}'
@@ -229,8 +236,6 @@ def addrecord(self, Id=None, value=None, time=None, comment=None, sample=None, o
         result = Record(id=Id, time=time, value=value, dataset=self,
                         comment=comment, sample=sample)
         session.add(result)
-        self.start = min(self.start, time)
-        self.end = max(self.end, time)
         return result
 
     def adjusttimespan(self):
diff --git a/odmf/plot/plot.py b/odmf/plot/plot.py
index 65a3c9eb..4a68b426 100644
--- a/odmf/plot/plot.py
+++ b/odmf/plot/plot.py
@@ -70,23 +70,26 @@ def generate_name(self):
                                       self.subplot.plot.aggregate)
         return name
 
-    def getdatasets(self, session, userlevel=10):
+    def getdatasets(self, session):
         """
         Loads the datasets for this line
         """
-
+        from ..webpage.auth import users
+        me = users.current
         datasets = session.query(db.Dataset).filter(
             db.Dataset._valuetype == self.valuetypeid,
             db.Dataset._site == self.siteid,
             db.Dataset.start <= self.subplot.plot.end,
-            db.Dataset.end >= self.subplot.plot.start,
-            db.Dataset.access <= userlevel
+            db.Dataset.end >= self.subplot.plot.start
         )
         if self.instrumentid:
             datasets = datasets.filter(db.Dataset._source == self.instrumentid)
         if self.level is not None:
             datasets = datasets.filter(db.Dataset.level == self.level)
-        return datasets.order_by(db.Dataset.start).all()
+        return [
+            ds for ds in datasets.order_by(db.Dataset.start)
+            if ds.get_access_level(me) >= ds.access
+        ]
 
     def load(self, start=None, end=None):
         """
diff --git a/odmf/static/media/js/dataset-edit.js b/odmf/static/media/js/dataset-edit.js
index 09779eab..8051904f 100644
--- a/odmf/static/media/js/dataset-edit.js
+++ b/odmf/static/media/js/dataset-edit.js
@@ -1,5 +1,5 @@
 function loadstatistics(dsid) {
-    $.getJSON(odmf_ref('/dataset/statistics/'),{id:dsid},function(data){
+    $.getJSON(odmf_ref('/dataset/' + dsid + '/statistics/'),{},function(data){
         $('#mean').html(data.mean.toPrecision(4));
         $('#std').html(data.std.toPrecision(4));
         $('#splitthreshold').val(data.std.toPrecision(4));
@@ -166,7 +166,7 @@ $(function() {
         'It has ' + btn.data('dssize') + ' records!'
         var really=confirm(msg)
         if (really) {
-            $.post(odmf_ref('/dataset/remove/') + btn.data('dsid'), data => {
+            $.post('remove', data => {
                 if (data) {
                     $('#error').html(data);
                     $('#error-row').removeClass('d-none');
diff --git a/odmf/static/templates/dataset-edit.html b/odmf/static/templates/dataset-edit.html
index 5094185d..2278878a 100644
--- a/odmf/static/templates/dataset-edit.html
+++ b/odmf/static/templates/dataset-edit.html
@@ -46,41 +46,40 @@
             <div class="row">
                 <div class="col">
                     <div class="nav flex-column nav-pills" role="tablist"  aria-orientation="vertical" id="tabs">
-                        <a id="description-tab" class="nav-link active border-top" data-toggle="pill" href="#description">dataset</a>
-                        <a id="edit-tab" class="nav-link border-top" data-toggle="pill" href="#edit"
-                           py:if="is_member('editor') and users.current.level>=ds_act.access"
+                        <a id="description-tab" class="nav-link ${['', 'active'][ds_act.is_defined()]} border-top" data-toggle="pill" href="#description">dataset</a>
+                        <a id="edit-tab" class="nav-link ${['', 'active'][not ds_act.is_defined()]} border-top" data-toggle="pill" href="#edit"
+                           py:if="access(Level.editor)"
                         >edit</a>
                         <a id="add-record-tab" class="nav-link border-top" data-toggle="pill" href="#add-record"
-                           py:if="is_member('editor') and users.current.level>=ds_act.access">
+                           py:if="access(Level.editor) and ds_act.is_defined()">
                             add record
                         </a>
-                        <a id="similar-tab" class="nav-link border-top" data-toggle="pill" href="#similar">similar</a>
 
                         <a id="transforms-tab" class="nav-link flexbox border-top"
                            data-toggle="pill" href="#transforms"
-                           py:if="ds_act and ds_act.is_transformed()"
+                           py:if="ds_act.is_defined() and ds_act.is_transformed()"
                         >
                             transforms
                         </a>
                         <a id="plot-tab" class="nav-link flexbox border-top" data-toggle="pill"
-                           py:if="users.current.level >= ds_act.access"
+                           py:if="access(Level.guest) and ds_act.is_defined()"
                            href="#plot"
                         >plot
                         </a>
                         <a id="records-tab" class="nav-link flexbox border-top" data-toggle="pill"
-                           py:if="ds_act.is_timeseries() and is_member('editor') and users.current.level >= ds_act.access"
+                           py:if="access(Level.editor)"
                            href="#records">
                             records
                         </a>
                         <a id="calibrate-tab" class="nav-link flexbox border-top" data-toggle="pill"
-                           py:if="ds_act.is_timeseries() and is_member('editor') and users.current.level>=ds_act.access"
+                           py:if="access(Level.editor)"
                            href="#calibrate"
 
                         >
                             calibrate
                         </a>
                         <a id="export-tab"
-                           py:if="is_member('logger') and users.current.level>=ds_act.access"
+                           py:if="access(Level.logger)"
                            href="#export" class="nav-link flexbox border-top" data-toggle="pill">
                             export
                         </a>
@@ -114,15 +113,22 @@ <h1 class="display-3 col-lg-2">Error</h1>
             <div id="title-row" class="row mt-2 w-100">
                 <div class="container">
                     <div id="title-area" class="container bg-dark text-white row w-100 border rounded shadow" py:if="ds_act" py:with="n=ds_act.size()">
-                        <div class="col-sm">
-                            <h2 class="display-3">ds<span id="dsid" py:content="ds_act.id"/></h2>
+                        <div class="col-sm row">
+                            <h2 class="display-3 col-sm">ds<span id="dsid" py:content="ds_act.id"/></h2>
+                            <div class="col-sm">
+                                <div class="badge bg-info text-bg-info " py:content="ds_act.get_access_level(users.current).name" />
+                                <div class="" py:content="ds_act.project"/>
+                            </div>
                         </div>
+
                         <div class="col-sm my-auto">
                             <h3 >
                                 <span py:content="formatdate(ds_act.start)"/> -
                                 <span py:content="formatdate(ds_act.end)"/>
                             </h3>
-                            <h3 py:content="ds_act.name"></h3>
+                            <h3 py:content="ds_act.name"/>
+
+
 
                         </div>
                         <div class="lead col-sm my-auto">
@@ -135,11 +141,10 @@ <h3 py:content="ds_act.name"></h3>
                         </div>
                     </div>
                 </div>
-
             </div>
             <div id="no-access-row" class="row mt-2 w-100">
                 <div class="container">
-                    <div class="container bg-warning row w-100 border rounded"  py:if="ds_act.access > users.current.level ">
+                    <div class="container bg-warning row w-100 border rounded"  py:if="not access()">
                         <h4 class="col-lg-4">Sorry, ${user()}</h4>
                         <div class="lead col-lg-8">
                             This dataset is not available for you. Ask the owner to get access.
@@ -148,9 +153,14 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
 
                 </div>
             </div>
+
             <div id="tab-row" class="tab-content row w-100 mt-2">
-                <div id="description" class="tab-pane active mx-auto" role="tabpanel" >
+                <div id="description" class="tab-pane mx-auto ${['', 'active'][ds_act.is_defined()]}" role="tabpanel" >
                     <table class="table mx-auto">
+                        <tr>
+                            <td class="bold">Project:</td>
+                            <td py:with="prj=ds_act.project"><a py:if="prj" href="${f'{conf.root_url}/project/{prj.id}'}" py:content="prj.name"/></td>
+                        </tr>
                         <tr>
                             <td class="bold">Type:</td>
                             <td>${ds_act.type}</td>
@@ -167,28 +177,33 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
 
                             </td>
                         </tr>
-                        <tr py:if="ds_act.valuetype">
+                        <tr id="desc_valuetype">
                             <td class="bold">Data:</td>
-                            <td><a href="${conf.root_url}/valuetype/${ds_act.valuetype.id}" class="tooltip">
-                            ${ds_act.valuetype.name}
-                                <span>${ds_act.valuetype.comment}</span>
-                            </a>
+                            <td py:if="ds_act.valuetype">
+                                <a href="${conf.root_url}/valuetype/${ds_act.valuetype.id}" class="tooltip">
+                                    ${ds_act.valuetype.name}
+                                    <span>${ds_act.valuetype.comment}</span>
+                                </a>
                                 <span id="statistics" >
-                                <span id="mean">?</span> &plusmn; <span id="std">?</span> ${ds_act.valuetype.unit}, n=<span id="n">${n}</span>
-                            </span>
+                                    <span id="mean">?</span>
+                                    &plusmn;
+                                    <span id="std">?</span>
+                                    ${ds_act.valuetype.unit},
+                                    n=<span id="n">${n}</span>
+                                </span>
                             </td>
                         </tr>
-                        <tr py:if="ds_act.site">
+                        <tr>
                             <td class="bold">Site:</td>
                             <td>
-                                <a href="${conf.root_url}/site/${ds_act.site.id}" py:content="ds_act.site" />
+                                <a href="${conf.root_url}/site/${ds_act._site}" py:content="ds_act.site" />
                             </td>
                         </tr>
-                        <tr py:if="ds_act.measured_by">
+                        <tr>
                             <td class="bold">Responsible:</td>
                             <td>
                                 <a href="${conf.root_url}+ '/user/' + (ds_act.measured_by.username if ds_act.measured_by else '')">
-                                        ${ds_act.measured_by}
+                                    ${ds_act.measured_by}
                                 </a>
                             </td>
                         </tr>
@@ -196,9 +211,9 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
                             <td class="bold">Quality:</td>
                             <td py:content="ds_act.quality" />
                         </tr>
-                        <tr py:if="ds_act.source">
+                        <tr>
                             <td class="bold">Data source:</td>
-                            <td>
+                            <td py:if="ds_act.source">
                                 <a href="${conf.root_url}/instrument/${ds_act.source.id}" py:content="ds_act.source" />
                                 <a py:if="ds_act.source.manuallink" href="${conf.root_url}/${ds_act.source.manuallink}" class="ml-4"
                                    title="Open manual for ${ds_act.source}" data-toggle="tooltip"
@@ -207,10 +222,10 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
                                 </a>
                             </td>
                         </tr>
-                        <tr py:if="ds_act.project">
+                        <tr id="desc-project">
                             <td class="bold">Project:</td>
-                            <td>
-                                <a href="${conf.root_url}/project/${ds_act.project}" py:content="activeproject.name"></a>
+                            <td py:if="ds_act.project">
+                                <a href="${conf.root_url}/project/${ds_act.project.id}" py:content="ds_act.project.name"></a>
                             </td>
                         </tr>
                         <tr py:if="ds_act.is_timeseries() and ds_act.quality and ds_act.quality.id>=3">
@@ -221,29 +236,27 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
                             <td class="bold">Transformation:</td>
                             <td class="big">$~f(x)=${ds_act.latex}~$</td>
                         </tr>
-                        <tr>
+                        <tr id="desc-comment">
                             <td class="bold">Comment:</td>
                             <td>
                                 <div py:content="markdown(ds_act.comment)" style="white-space: pre-line;"/>
                             </td>
                         </tr>
                     </table>
-                    <button py:if="ds_act.is_timeseries() and is_member('editor')" id="create-transformation"
+                    <button py:if="ds_act.is_timeseries() and access(Level.editor)" id="create-transformation"
                             class="btn btn-outline-primary mr-2" data-toggle="tooltip"
                             title="Create a transformed dataset for this">
                         $~f(x)~$ transform
                     </button>
-                    <button py:if="is_member('admin')" class="btn btn-outline-danger mr-2"
+                    <button py:if="access(Level.admin)" class="btn btn-outline-danger mr-2"
                             title="remove dataset permanently" data-toggle="tooltip" id="removeds"
                             data-dsid="${ds_act.id}" data-dsname="${str(ds_act)}" data-dssize="${ds_act.size()}">
                         <i class="fas fa-trash mr-2"/> delete dataset
                     </button>
-
-
                 </div>
-                <div id="edit" class="tab-pane w-100 mr-4" role="tabpanel" py:if="is_member('editor') and users.current.level>=ds_act.access">
-                    <form action="${conf.root_url}/dataset/saveitem" method="post">
-                        <input type="hidden" name="id" value="${ds_act.id}" id="id-input" />
+                <div id="edit" class="tab-pane w-100 mr-4 ${['', 'active'][not ds_act.is_defined()]}" role="tabpanel" py:if="access(Level.editor)">
+                    <form action="save" method="post">
+                        <input type="hidden" name="id" value="${ds_act.id}"  />
                         <div class="container w-100">
                             <div id="edit-top-buttons" class="form-row mb-2">
 
@@ -277,7 +290,7 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
                                             </a>
                                         </div>
                                         <select class="form-control border-secondary" id="measured_by"
-                                                name="measured_by">
+                                                name="measured_by" py:attrs="disabled(not access(Level.admin))">
                                             <option value="" disabled="disabled">Please select...</option>
                                             <option py:for="p in persons"
                                                     py:attrs="markoption(p is ds_act.measured_by)"
@@ -320,12 +333,12 @@ <h4 class="col-lg-4">Sorry, ${user()}</h4>
                                     <label for="project">
                                         Project
                                     </label>
-                                    <select py:if="is_member('supervisor')" id="project" name="project" class="form-control">
+                                    <select py:attrs="disabled(not access(Level.admin))" id="project" name="project" class="form-control">
                                         <option value="0" >No Project</option>
                                         <option value="${p.id}"
                                                 py:for="p in projects"
                                                 py:content="p.name"
-                                                py:attrs="markoption(p.id == ds_act.project)"></option>
+                                                py:attrs="markoption(p == ds_act.project)"></option>
                                     </select>
 
                                 </div>
@@ -550,7 +563,6 @@ <h4 class="card-title">Some help for the Python and latex expressions</h4>
                                 <label for="filename">filename</label>
                                 <input id="filename" name="filename" class="form-control" type="text" value="${ds_act.filename}"/>
                             </div>
-
                             <div class="form-row">
                                 <label for="comment">Comments:</label>
                                 <textarea id="comment" name="comment"
@@ -559,29 +571,28 @@ <h4 class="card-title">Some help for the Python and latex expressions</h4>
                                           py:content="ds_act.comment" />
                             </div>
                         </div>
-
                     </form>
                 </div>
-                <div id="add-record" class="tab-pane w-100 mr-4" role="tabpanel" py:if="is_member('editor') and users.current.level>=ds_act.access">
+                <div id="add-record" class="tab-pane w-100 mr-4" role="tabpanel" py:if="access(Level.editor) and ds_act.valuetype">
                     <h3>Add value...</h3>
                     <form action="${conf.root_url}/dataset/add-record" method="post">
-                       <input type="hidden" name="dataset" value="${ds_act.id}" id="id-input" />
-                       <div class="container w-100">
-                           <div class="form-group">
-                               <label for="add-record-value">value in ${ds_act.valuetype.unit}</label>
-                               <input id="add-record-value" type="number" name="value" class="form-control"/>
-                           </div>
-                           <div class="form-group">
-                               <label for="add-record-time">time</label>
-                               <input id="add-record-time" type="datetime-local" name="time" class="form-control"/>
-                           </div>
-                           <div class="form-group">
-                               <label for="add-record-comment">comment</label>
-                               <input id="add-record-comment" type="text" name="comment"  class="form-control"/>
-                           </div>
-                          <input type="submit" />
-
-                       </div>
+                        <input type="hidden" name="dataset" value="${ds_act.id}" id="id-input" />
+                        <div class="container w-100">
+                            <div class="form-group">
+                                <label for="add-record-value">value in ${ds_act.valuetype.unit}</label>
+                                <input id="add-record-value" type="number" name="value" class="form-control"/>
+                            </div>
+                            <div class="form-group">
+                                <label for="add-record-time">time</label>
+                                <input id="add-record-time" type="datetime-local" name="time" class="form-control datetime-local-now"/>
+                            </div>
+                            <div class="form-group">
+                                <label for="add-record-comment">comment</label>
+                                <input id="add-record-comment" type="text" name="comment"  class="form-control"/>
+                            </div>
+                            <input type="submit" />
+
+                        </div>
 
                     </form>
                 </div>
@@ -614,7 +625,6 @@ <h3>This data set transforms the records of the following <span py:content="len(
                         </li>
                     </ul>
                 </div>
-
                 <div id="plot" class="tab-pane w-100 mr-4" role="tabpanel" py:if="users.current.level>=ds_act.access">
                     <div class="container mx-auto">
                         <div class="row">
@@ -703,21 +713,8 @@ <h3>This data set transforms the records of the following <span py:content="len(
                     </div>
 
                 </div>
-                <div id="similar" class="tab-pane" role="tabpanel" >
-                    <div py:for="dsname in datasets" >
-                        <h3>${dsname}</h3>
-                        <div id="${dsname.replace(' ','_')}">
-                            <ul>
-                                <li py:for="ds in datasets[dsname]">
-                                    <a href="${ds.id}">${ds}</a>
-                                </li>
-
-                            </ul>
-                        </div>
-                    </div>
-                </div>
                 <div id="records" class="tab-pane" role="tabpanel"
-                     py:if="is_member('editor') and ds_act and ds_act.is_timeseries() and users.current.level>=ds_act.access">
+                     py:if="ds_act.is_timeseries() and access(Level.editor)">
                     <div class="row w-100">
                         <div class="col-sm">
                             <button class="btn btn-primary w-100" id="find-records">find records</button>
@@ -792,7 +789,7 @@ <h3>${dsname}</h3>
 
                 </div>
                 <div id="calibrate" class="tab-pane" role="tabpanel"
-                     py:if="ds_act.is_timeseries() and is_member('editor') and users.current.level>=ds_act.access">
+                     py:if="ds_act.is_timeseries() and access(Level.editor)">
                     <div class="row">
                         <div class="col-sm-11">
                             <div class="input-group">
@@ -801,7 +798,7 @@ <h3>${dsname}</h3>
                                 </div>
                                 <select id="calibrate-select-source" class="form-control">
                                     <option value="" style="font-style: italic;">&lt;Please select...&gt;</option>
-                                    <option py:for="ds in datasets['same time']" value="${ds.id}"
+                                    <option py:for="ds in same_time_ds" value="${ds.id}"
                                             py:content="ds"/>
                                 </select>
                             </div>
@@ -920,7 +917,7 @@ <h4 class="col ml-2">Bias correction $~y = x + c~$</h4>
 
 
                 </div>
-                <div id="export" class="tab-pane" role="tabpanel" py:if="is_member('logger') and users.current.level>=ds_act.access">
+                <div id="export" class="tab-pane" role="tabpanel" py:if="access(Level.logger)">
                     <ul>
                         <li py:if="ds_act">
                             <a class="btn btn-primary" href="${conf.root_url}/dataset/records.csv?dataset=${ds_act.id}">
@@ -931,6 +928,7 @@ <h4 class="col ml-2">Bias correction $~y = x + c~$</h4>
                     </ul>
                 </div>
             </div>
+
         </div>
     </py:block>
 
diff --git a/odmf/static/templates/datasetlist.html b/odmf/static/templates/datasetlist.html
index cc1bfe04..ccf5957e 100644
--- a/odmf/static/templates/datasetlist.html
+++ b/odmf/static/templates/datasetlist.html
@@ -16,6 +16,7 @@
 
                 }
 
+                let pr = $('#prselect').val()
                 let vt = $('#vtselect').val()
                 let user = $('#userselect').val()
                 let site = $('#siteselect').val()
@@ -38,9 +39,11 @@
                             date:date,
                             dstype:type,
                             instrument:instrument,
+                            project:pr
                         },
                         data => {
                             $('#userselect').html(options(data.measured_by, x=>x.username, fmt.user))
+                            $('#prselect').html(options(data.project, fmt.id, fmt.name)).val(pr);
                             $('#vtselect').html(options(data.valuetype, fmt.id, fmt.name)).val(vt);
                             $('#siteselect').html(options(data.site, fmt.id, fmt.site)).val(site);
                             $('#instrumentselect').html(options(data.source, fmt.id, fmt.name)).val(instrument)
@@ -59,6 +62,7 @@
                 var date = $('#dateselect').val();
                 var type = $('#typeselect').val();
                 var instrument = $('#instrumentselect').val();
+                let project = $('#prselect').val();
                 let limit = $('#limit').val();
                 let page = $('#page').val();
                 $.getJSON(odmf_ref('/dataset/json'),
@@ -69,14 +73,15 @@
                             date:date,
                             dstype:type,
                             instrument:instrument,
+                            project: project,
                             limit: limit,
                             page: page
                         },
                         function(data){
                             var items = [];
-                            var templ = '<a href="${conf.root_url}/dataset/ID" class="list-group-item list-group-item-action">LABEL</a>';
+                            var templ = '<a href="${conf.root_url}/dataset/ID" class="list-group-item list-group-item-action">LABEL <span class="badge badge-warning float-right">ACL</span></a>';
                             $.each( data.datasets, function( index, item ) {
-                                items.push(templ.replace(/ID/, item.id).replace(/LABEL/, item.label));
+                                items.push(templ.replace(/ID/, item.id).replace(/LABEL/, item.label).replace(/ACL/, item.accesslevel));
                             });
                             $('#dscount').html(((data.page - 1) * data.limit) + ' - ' + (data.page * data.limit) + ' of ' + data.count + ' datasets');
                             $('#dslist').html(items.join('\n'));
@@ -155,6 +160,10 @@ <h4 class="col-sm-10"><i class="fas fa-filter fa-sm mr-2" />Filter</h4>
                         <i class="fas fa-times" />
                     </a>
                 </div>
+                <div class="form-group mb-1 row">
+                    <label for="prselect" class="small m-0">Project</label>
+                    <select id="prselect" class="form-control form-select filter" tabindex="2"/>
+                </div>
                 <div class="form-group mb-1 row">
                     <label for="vtselect" class="small m-0">Value type</label>
                     <select id="vtselect" class="form-control form-select filter" tabindex="2"/>
diff --git a/odmf/static/templates/download.html b/odmf/static/templates/download.html
index 4b2cfdce..00e81873 100644
--- a/odmf/static/templates/download.html
+++ b/odmf/static/templates/download.html
@@ -126,10 +126,11 @@ <h5>content</h5>
                     <a class="nav-link" href="${curdir.parent().href}" ><i class="fas fa-folder-open mr-2" />..</a>
 
                 </li>
-                <li py:for="d in sorted(directories)" class="nav-item border-top" >
-                    <a class="nav-link" href="${d.href}">
+                <li py:for="d in sorted(directories)" class="nav-item border-top " >
+                    <a class="nav-link ${'' if modes[d] else 'disabled'}" href="${d.href}">
                         <i class="fas fa-folder mr-2" /> ${d.basename}
                     </a>
+
                 </li>
             </ul>
             <div class="container m-1 p-1">
@@ -149,7 +150,6 @@ <h5>content</h5>
                     </div>
                 </div>
             </div>
-
             <div class="alert alert-success" role="alert" py:if="message" >
                 <div class="row">
                     <div class="col-lg-1">
@@ -160,14 +160,14 @@ <h5>content</h5>
                     </div>
                 </div>
             </div>
-            <div class="row" py:if="curdir.isdir()">
+            <div class="row" py:if="curdir.isdir() and modes[curdir]">
 
                 <div class="col-xl">
-                    <div class="row" py:if="is_member('logger')">
-                    </div>
                     <div class="card p-3" >
                         <h5 class="card-title">
-                            <i class="fas fa-folder-open mr-2"/><span py:for="bc in curdir.breadcrumbs()">/<a href="${bc.href}" py:content="bc.basename" /></span>
+                            <i class="fas fa-folder-open mr-2"/>
+                            <span py:for="bc in curdir.breadcrumbs()">/<a href="${bc.href}" py:content="bc.basename" /></span>
+                            <span class="badge bg-warning ml-8 float-right" py:content="modes[curdir].name"/>
                         </h5>
                         <ul class="nav flex-column card-text mb-3" id="files">
                             <li class="nav-item flexbox mt-1 pt-1 border-top" py:if="not curdir.isroot()" >
@@ -179,21 +179,22 @@ <h5 class="card-title">
                                 </span>
                             </li>
                             <li py:for="d in directories" class="nav-item flexbox mt-1 pt-1 border-top">
-                                <span >
-                                    <a href="${d.href}" class="nav-link">
+                                <span class="nav-link">
+                                    <a href="${d.href}" class="${'' if modes[d] else 'disabled'}">
                                         <i class="fas fa-folder fa-lg" />
                                         <span py:content="d.basename" />
-                                        </a>
+                                    </a>
+                                    <span class="badge bg-warning text-bg-warning" py:content="modes[d].name"/>
                                 </span>
                                 <span>
                                     <button class="btn btn-danger remove-button" data-name="${d.basename}"
-                                            py:if="is_member('admin') and d.isempty()"
-                                            title="remove file" data-toggle="tooltip">
+                                            py:if="modes[d]>=Mode.admin and d.isempty()"
+                                            title="remove directory" data-toggle="tooltip">
                                         <i class="fas fa-times-circle" />
                                     </button>
                                 </span>
                             </li>
-                            <li py:for="f in files" class="nav-item flexbox mt-1 pt-1 border-top" py:if="not f.ishidden()">
+                            <li py:for="f in files" class="nav-item flexbox mt-1 pt-1 border-top" >
                                 <span >
                                     <a href="${f.href}" class="nav-link">
                                         <i class="fas fa-${handler[f].icon} fa-lg" />
@@ -204,32 +205,38 @@ <h5 class="card-title">
                                 <span>
                                     <a class="btn btn-success" href="${conf.root_url}/download/to_db?filename=${f.name}"
                                        title="import in data base" data-toggle="tooltip"
-                                       py:if="is_member('editor')"
+                                       py:if="modes[curdir]>=Mode.write"
                                     >
                                         <i class="fas fa-file-import" />
                                     </a>
-                                    <button class="btn btn-danger remove-button" data-name="${f.basename}" py:if="is_member('admin')"
+                                    <button class="btn btn-danger remove-button" data-name="${f.basename}" py:if="modes[curdir]>=Mode.admin"
                                             title="remove file" data-toggle="tooltip">
                                         <i class="fas fa-times-circle" />
                                     </button>
-                                    <button class="btn btn-secondary copy-button" data-name="${f.basename}" py:if="is_member('editor')"
+                                    <button class="btn btn-secondary copy-button" data-name="${f.basename}" py:if="modes[curdir]>=Mode.write"
                                             title="copy file" data-toggle="tooltip">
                                         <i class="fas fa-copy" />
                                     </button>
                                 </span>
 
-                            </li>
-                            <li py:if="is_member('logger')" class="nav-item mt-4">
-
                             </li>
                         </ul>
-                        <div class="container">
-                            <button class="btn btn-secondary dropdown-toggle mr-3" type="button"
-                                    id="addFileDropdownButton" data-toggle="dropdown"
+                        <div class="row">
+                            <button class="btn btn-primary dropdown-toggle mr-3 col-sm" type="button"
+                                    id="addFileDropdownButton" data-toggle="dropdown" py:attrs="prop(disabled=modes[curdir]==Mode.read)"
                                     aria-haspopup="true" aria-expanded="false">
                                 <i class="fas fa-plus-circle" />
                                 Add files and folders
                             </button>
+                            <form method="post" action="${conf.root_url}/download/create_access_file" class="col-sm">
+                                <button class="btn btn-warning mr-3" type="submit" name="uri" value="${curdir}"
+                                   py:if="modes[curdir]==Mode.admin"
+                                >
+                                    <i class="fas fa-cog" /> manage access
+                                </button>
+
+                            </form>
+
                             <div class="dropdown-menu" aria-labelledby="addFileDropdownButton">
                                 <div class="dropdown-item" >
 
@@ -237,12 +244,12 @@ <h5 class="card-title">
                                         <div class="input-group">
                                             <input type="text" name="newfolder" class="form-control" placeholder="new folder name"/>
                                             <span class="input-group-append">
-                                        <button class="btn btn-secondary" type="submit"
-                                                title="Add new folder" data-toggle="tooltip" data-placement="right"
-                                        >
-                                            <i class="fa fa-folder-plus"></i>
-                                        </button>
-                                    </span>
+                                                    <button class="btn btn-secondary" type="submit"
+                                                            title="Add new folder" data-toggle="tooltip" data-placement="right"
+                                                    >
+                                                        <i class="fa fa-folder-plus"></i>
+                                                    </button>
+                                                </span>
                                         </div>
                                         <input name="dir" type="hidden" value="${curdir}" />
                                     </form>
@@ -287,12 +294,12 @@ <h5 class="card-title">
                                         </div>
                                     </form>
                                 </div>
+
                             </div>
                         </div>
-
                     </div>
                 </div>
-                <div class="col-lg">
+                <div id="info-box-right-side" class="col-lg">
                     <div class="card help">
                         <div class="card-header">
                             <h3 class="card-title flexbox" >
@@ -304,6 +311,8 @@ <h3 class="card-title flexbox" >
                                     <i class="fas fa-edit" title="Click to edit..." data-toggle="tooltip"/>
                                 </a>
                             </h3>
+                            <div py:content="markdown('folder created by user:' + str(owner))"/>
+
                         </div>
                         <div id="help" class="card-body  card-text" />
                         <div id="help-edit" class="card-footer collapse">
@@ -325,13 +334,13 @@ <h3 class="card-title flexbox" >
                     </div>
                 </div>
             </div>
-            <div class="row" py:if="defined('content')">
+            <div class="row" py:if="content and modes[curdir]">
                 <h5 class="col-lg-9">
                     <i class="fas fa-${handler[curdir].icon} fa-lg mr-2"/><span py:for="bc in curdir.breadcrumbs()">/<a href="${bc.href}" py:content="bc.basename" /></span>
                 </h5>
                 <div class="col-lg-3">
                     <a py:for="action_id, action in enumerate(handler[curdir].actions)"
-                       py:if="has_level(action.access_level)"
+                       py:if="modes[curdir]==Mode.admin"
                        class="btn btn-secondary action-button"
                        data-toggle="tooltip" title="${action.tooltip}"
                        data-actionid="${action_id}" data-path="${curdir}">
@@ -341,7 +350,7 @@ <h5 class="col-lg-9">
                     <a class="btn btn-outline-primary" href="${curdir.parent().href}"><i class="fas fa-folder-open mr-4"/>..</a>
                 </div>
             </div>
-            <div class="row" py:if="defined('content')">
+            <div class="row" py:if="content and modes[curdir]">
                 <div class="container mt-4 h100" py:content="literal(content)"/>
             </div>
         </div>
diff --git a/odmf/static/templates/layout.html b/odmf/static/templates/layout.html
index 445e3e8a..972ccdf4 100644
--- a/odmf/static/templates/layout.html
+++ b/odmf/static/templates/layout.html
@@ -49,6 +49,16 @@
 
     <script>
         //<![CDATA[
+        function datetime_local_now() {
+            // https://stackoverflow.com/a/60884408/3032680
+            var now = new Date();
+            now.setMinutes(now.getMinutes() - now.getTimezoneOffset());
+
+            /* remove second/millisecond if needed - credit ref. https://stackoverflow.com/questions/24468518/html5-input-datetime-local-default-value-of-today-and-current-time#comment112871765_60884408 */
+            now.setMilliseconds(null)
+            now.setSeconds(null)
+            return now.toISOString().slice(0, -1);
+        }
         $(function () {
             $('[data-toggle="tooltip"]').tooltip();
             $('#login-logout').click(() => {
@@ -72,6 +82,7 @@
                     });
                 return false;
             });
+            $('.datetime-local-now').val(datetime_local_now())
 
         });
         //]]>
diff --git a/odmf/static/templates/person.html b/odmf/static/templates/person.html
index 6e1ad5cb..6603c5fe 100644
--- a/odmf/static/templates/person.html
+++ b/odmf/static/templates/person.html
@@ -113,7 +113,7 @@ <h1 py:content="active_person"/>
                         />
                     </div>
                 </div>
-                <div class="form-group row" py:if="is_member('admin') or is_self(U.username) or act_user=='new'">
+                <div class="form-group row" py:if="is_member(Level.admin) or is_self(U.username) or act_user=='new'">
                     <label for="password" class="col-lg-2 col-form-label">password</label>
                     <div class="col-lg-4">
                         <input type="password" id="password" name="password"
@@ -139,11 +139,10 @@ <h1 py:content="active_person"/>
                                 py:attrs="prop(disabled=not (is_member('supervisor') or is_self(U.username)))"
                                 class="form-control"
                         >
-                            <option py:for="value in levels(users.current.level)"
-                                    py:content="value[0]"
-                                    py:if="int(users.current.level)>=int(value[1])"
-                                    value="${value[1]}"
-                                    py:attrs="markoption(str(value[1]) == str(U.access_level))"/>
+                            <option py:for="l in Level"
+                                    py:content="l.name"
+                                    value="${l.value}"
+                                    py:attrs="prop(selected=l.value == U.access_level, disabled=l>users.current.level)"/>
                         </select>
                     </div>
                     <div class="col-lg-2"></div>
@@ -167,7 +166,7 @@ <h1 py:content="active_person"/>
 
                 <div class="form-group row">
                     <button type="submit" class="col-lg-2 btn btn-primary w-100"
-                            py:attrs="prop(disabled=not (is_member('supervisor') or is_self(U.username)))"
+                            py:attrs="prop(disabled=not (is_member(Level.supervisor) or is_self(U.username)))"
                     >
                         save
                     </button>
@@ -175,6 +174,14 @@ <h1 py:content="active_person"/>
                 </div>
             </form>
 
+            <h2 class="mt-4">Projects:</h2>
+            <div class="list-group">
+                <a py:for="project, level in active_person.projects()" href="${f'{conf.root_url}/project/{project.id}'}" class="list-group-item list-group-item-action">
+                    <span py:content="project.name"/>
+                    <span class="badge badge-warning float-right" py:content="level.name"/>
+                </a>
+            </div>
+
         </div>
 
 
diff --git a/odmf/static/templates/project.html b/odmf/static/templates/project.html
new file mode 100644
index 00000000..670ec237
--- /dev/null
+++ b/odmf/static/templates/project.html
@@ -0,0 +1,221 @@
+<!DOCTYPE html>
+
+<py:extends href="layout.html" xmlns:py="">
+    <py:block name="scripts">
+        <!-- insert additional scripts -->
+        <script type="text/javascript">
+            $(() =>{
+            });
+        </script>
+    </py:block>
+    <py:block name="style">
+        <!-- insert additional styles -->
+    </py:block>
+    <py:block name="sidebar">
+        <!-- insert sidebar content -->
+        <div class="container-fluid">
+            <a class="btn btn-secondary w-100 mb-4" href="${conf.root_url}/project/">
+                <i class="fas fa-list mr-2"/>
+                list
+            </a>
+            <a class="btn btn-secondary w-100 mb-4" href="${conf.root_url}/project/new" py:if="is_member(Level.admin)">
+                <i class="fas fa-plus mr-2"/>
+                new project
+            </a>
+            <div class="nav flex-column nav-pills">
+                <a py:for="proj in projects"
+                   class="nav-link ${['', 'active'][bool(actproject and proj.id==actproject.id)]} ${'' if is_member(Level.logger) else 'disabled'}"
+                   href="${f'{conf.root_url}/project/{proj.id}'}"
+                   py:content="f'{proj.id} - {proj.name}'"
+                />
+            </div>
+
+        </div>
+
+    </py:block>
+    <py:block name="content">
+        <div class="container m-0 p-0">
+            <div class="alert bg-danger text-white" role="alert" py:if="error">
+                <div class="row">
+                    <div class="col-lg-1">
+                        <i class="fas fa-exclamation-circle fa-3x"/>
+                    </div>
+                    <div class="col-lg-11">
+                        <p class="lead" py:content="markdown(error)"/>
+                    </div>
+                </div>
+            </div>
+            <div class="alert alert-success" role="alert" py:if="msg" >
+                <div class="row">
+                    <div class="col-lg-1">
+                        <i class="fas fa-info-circle fa-3x"/>
+                    </div>
+                    <div class="col-lg-11">
+                        <p class="" py:content="markdown(msg)"/>
+                    </div>
+                </div>
+            </div>
+            <py:if test="(not actproject) or Level.my(actproject.id)==Level.guest">
+            <div id="list-title-area"
+                 class="container bg-dark text-white w-100 border rounded flexbox shadow mb-4">
+                <h2 class="display-4 mr-8">Projects</h2>
+                <div class="display-4 col-sm my-auto text-right">
+                    <i class="fas fa-user-friends mr-4"/>
+                </div>
+            </div>
+            <div class="list-group" id="project-list">
+                <a py:for="project in projects"
+                   href="${project.id}"
+                   class="list-group-item list-group-item-action ${'' if Level.my(project.id)>Level.guest else 'disabled'}">
+                    <span class="h3" py:content="project.name"/>
+                    <span class="col-sm-1 badge badge-info float-right" py:content="Level.my(project.id).name"/>
+                </a>
+            </div>
+            </py:if><py:else>
+            <div class="container">
+                <div id="description">
+                    <div class="row mt-2 w-100">
+                        <div class="container">
+                            <div id="title-area"
+                                 class="container bg-dark text-white w-100 border rounded flexbox shadow mb-4">
+                                <div>
+                                    <h2 class="display-4 mr-8 d-inline-block" py:content="f'{actproject.name}'"/>
+                                    <div class="d-inline-block position-absolute top-0 end-0">
+                                        <span class="badge bg-info text-bg-info" py:content="Level.my(actproject.id).name" />
+                                    </div>
+
+                                </div>
+                                <div class="display-4 col-sm my-auto text-right">
+                                    <i class="fas fa-user-friends mr-4"/>${actproject.id}
+                                </div>
+                            </div>
+                            <div>
+                                <div class="float-right" py:if="is_member(Level.admin, actproject.id)">
+                                    <a class="btn btn-secondary dropdown-toggle" href="#edit" data-toggle="collapse">
+                                        <i class="fas fa-edit"/>
+                                    </a>
+                                </div>
+                                <div>
+                                    <div class="container border-bottom">
+                                        <a href="${actproject.sourcelink}">
+                                            <i class="fas fa-link mr-2"/>${actproject.name} homepage
+                                        </a>
+                                        by
+                                        <span class="badge badge-primary ml-2" py:content="actproject.organization"/>
+
+                                    </div>
+                                    <div class="container" py:with="p=actproject.person_responsible" py:content="markdown('Spokes person: user:' + (p.username if p else 'N/A'))"/>
+                                    <div class="container" py:content="markdown(actproject.comment)"/>
+                                </div>
+
+                            </div>
+
+
+                        </div>
+                    </div>
+
+                </div>
+                <div id="edit" class="container collapse border rounded px-4">
+                    <form action="save"
+                          method="post" py:if="is_member(Level.admin, actproject.id)"
+                    >
+                        <div class="form-row mt-2">
+                            <div class="form-group">
+                                <label for="id">ID:</label>
+                                <input type="text" id="id" class="form-control" value="${actproject.id}"
+                                       readonly="readonly"/>
+                            </div>
+                            <div class="form-group">
+                                <label for="name">Name:</label>
+                                <input type="text" id="name" name="name" class="form-control" value="${actproject.name}"/>
+                            </div>
+                        </div>
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label for="sourcelink">Link to project homepage</label>
+                                <input type="text" id="sourcelink" name="sourcelink" class="form-control"
+                                       value="${actproject.sourcelink}"/>
+                            </div>
+                            <div class="form-group">
+                                <label for="organization">Organization</label>
+                                <input type="text" id="organization" name="organization" class="form-control"
+                                       value="${actproject.organization}"/>
+                            </div>
+                        </div>
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label for="responsible">Spokes person</label>
+                                <select id="responsible" name="person" class="form-control">
+                                    <option value="${p.username}" py:content="f'{p} ({Level(p.access_level).name})'" py:for="p in supervisors" py:attrs="markoption(p == actproject.person_responsible)"/>
+                                </select>
+                            </div>
+                        </div>
+                        <div class="form-row mb-2">
+
+                            <label for="comment">Description:</label>
+                            <textarea id="comment" name="comment" class="form-control"
+                                      rows="4"
+                                      py:content="actproject.comment"/>
+                        </div>
+                        <button class="btn btn-success mb-2" type="submit" id="save">
+                            <i class="fas fa-save mr-2"/>
+                            save changes
+                        </button>
+                    </form>
+                </div>
+                <h2 class="border-bottom">Members</h2>
+                <div id="members" class="container">
+                    <ul>
+                        <li py:for="member, level in actproject.members()" class="form-row">
+                            <div class="col-sm">
+                                <span class="badge rounded-pill bg-warning" py:content="Level(level).name" />
+                                <span py:content="member" class="ml-2 mr-4"/>
+
+                            </div>
+
+                            <form class="col-sm" method="post" action="remove_member">
+                                <button data-member="${member.username}"
+                                        py:if="is_member(Level.admin, actproject.id)"
+                                        type="submit"
+                                        class="btn btn-danger btn-sm col-sm-1 pr-3 project-remove-member"
+                                        name="member_name" value="${member.username}"
+                                        title="remove" data-toggle="tooltip"
+                                >
+                                    <i class="fas fa-times"/>
+                                </button>
+
+                            </form>
+                        </li>
+                    </ul>
+                    <a href="#add-member" py:if="is_member(Level.admin, actproject.id)" class="btn-sm btn-primary dropdown-toggle" data-toggle="collapse" aria-controls="add-member" aria-role="button"><i class="fas fa-plus"/> add member...</a>
+                    <div py:if="is_member(Level.admin, actproject.id)" class="collapse" id="add-member">
+                        <form class="form-row border" method="post" action="add_member">
+                            <input type="hidden" value="${actproject.id}" xname="project_id"/>
+                            <select id="add_who" class="form-control col-sm" name="member_name">
+                                <option value="${p.username}" py:for="p in persons" py:content="f'{p} ({Level(p.access_level).name})'"/>
+                            </select>
+                            <select id="add_level" class="form-control col-sm-3" name="access_level">
+                                <option py:for="l in Level" value="${l.value}" py:content="l.name"/>
+                            </select>
+                            <button type="submit" id="addmember"
+                                    class="btn btn-success btn-sm col-sm-1 project-add-member"><i class="fas fa-check"/></button>
+                        </form>
+                    </div>
+
+                </div>
+                <h2 class="border-bottom">Datasets</h2>
+                <div id="datasets" class="container">
+                    <ul>
+                        <li py:for="ds in actproject.datasets">
+                            <a href="${conf.root_url}/dataset/${ds.id}"
+                               py:content="ds"/>
+                        </li>
+                    </ul>
+                </div>
+
+            </div>
+            </py:else>
+        </div>
+    </py:block>
+</py:extends>
+
diff --git a/odmf/static/templates/project_delete.html b/odmf/static/templates/project_delete.html
deleted file mode 100644
index 21069865..00000000
--- a/odmf/static/templates/project_delete.html
+++ /dev/null
@@ -1,69 +0,0 @@
-<!DOCTYPE html>
-<html>
-
-<head>
-    <!-- Server configuration, see conf.py for HEAD_BASE -->
-    <script>function odmf_ref(s) {return '${conf.root_url}' + s;}</script>
-
-	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" integrity="sha512-dTfge/zgoMYpP7QbHy4gWMEGsbsdZeCXz7irItjcC3sPUFtf0kuFbDz/ixG7ArTxmDjLXDmezHubeNikyKGVyQ==" crossorigin="anonymous" />
-
-	<link href="${conf.root_url}/media/css/odmf.css" rel="stylesheet" type="text/css"/>
-	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-	<title>Delete Project</title>
-</head>
-<style>
-    div.head {
-        display: inline-block;
-        border: 1px solid;
-        border-radius: 0.3em;
-        padding: 0.3em;
-        font-size: 1.2em;
-    }
-
-    div.info-text {
-        padding: 10px;
-    }
-
-	div.space {
-		margin-top: 10px;
-		margin-bottom: 5px;
-	}
-	div.short {
-		width: 40em;
-	}
-	input {
-		width: 100%;
-	}
-
-    /*Fix Bootstrap overwride*/
-    body {
-        line-height: normal;
-    }
-</style>
-<body>
-	${navigation('Delete Project: ' + project.name)}
-	<div class="content">
-        <div class="error" py:content="error" />
-        <a href="${conf.root_url}/project">Back to all project</a>
-
-        <div class="info-text">
-            <div class="head btn-danger"><strong>CAUTION:</strong> You want to delete <strong>${project.name}</strong>!</div>
-
-        <div class="space">If you delete the project. All datasets affected by the project
-            will be relieved from it and will stay in the database without a project.</div>
-        </div>
-
-        <form method="post" action="${conf.root_url}/project/delete">
-            <button id="btn-delete" type="submit"
-            class="btn btn-danger">Delete</button>
-            <input type="hidden" id="project_id" name="project_id" value="${project.id}" />
-            <input type="hidden" id="force" name="force" value="True" />
-		</form>
-
-		<h2>Data</h2>
-
-			<div></div>
-	</div>
-
-</body>
-</html>
\ No newline at end of file
diff --git a/odmf/static/templates/project_from_id.html b/odmf/static/templates/project_from_id.html
deleted file mode 100644
index ff9cef2d..00000000
--- a/odmf/static/templates/project_from_id.html
+++ /dev/null
@@ -1,143 +0,0 @@
-<!DOCTYPE html>
-<html>
-
-<head>
-    <!-- Server configuration, see conf.py for HEAD_BASE -->
-    <script>function odmf_ref(s) {return '${conf.root_url}' + s;}</script>
-
-	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" integrity="sha512-dTfge/zgoMYpP7QbHy4gWMEGsbsdZeCXz7irItjcC3sPUFtf0kuFbDz/ixG7ArTxmDjLXDmezHubeNikyKGVyQ==" crossorigin="anonymous" />
-
-	<link href="${conf.root_url}/media/css/odmf.css" rel="stylesheet" type="text/css"/>
-	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-	<title>Project: ${project.name}</title>
-</head>
-<style>
-	div.space {
-		margin-top: 10px;
-		margin-bottom: 5px;
-	}
-	div.short {
-		width: 40em;
-	}
-	input {
-		width: 100%;
-	}
-
-    /*Fix Bootstrap overwride*/
-    body {
-        line-height: normal;
-    }
-</style>
-<body>
-	${navigation('Project: ' + project.name)}
-	<div class="content">
-        <div class="error" py:content="error" />
-        <a href="${conf.root_url}/project">Back to all project</a>
-
-		<form method="post" action="change" class="form-horizontal">
-            <div class="form-group">
-				<label for="name" class="col-sm-2 control-label">Name</label>
-				<div class="col-sm-8">
-					<input name="name" id="name" type="text" class="form-control"
-							value="${project.name}" readonly="True"/>
-				</div>
-			</div>
-
-			<div class="form-group">
-				<label for="person"
-					   class="col-sm-2 control-label">Person responsible</label>
-				<div class="col-sm-8">
-					<a id="person_link" href="${conf.root_url}/user/${project.person_responsible.username}">${project.person_responsible}</a>
-					<select readonly="True" disabled="True" name="person" id="person" class="form-control" style="display: none;">
-						<option py:for="p in persons"
-								value="${p.username}"
-								py:content="p"
-								py:attrs="markoption(str(p.username) == str(project.person_responsible.username))"/>
-					</select>
-				</div>
-			</div>
-
-			<div class="form-group">
-				<label for="comment" class="col-sm-2 control-label">Comment</label><br/>
-				<div class="col-sm-8">
-                    <textarea name="comment" id="comment" class="form-control" rows="5" readonly="True">${project.comment}</textarea>
-				</div>
-			</div>
-
-            <!-- Comment -->
-            <div class="row from-group">
-                <div class="col-sm-8 col-sm-offset-2" >
-                    <strong>Note:</strong> The comment is a description, which is part of the reponse, when
-                    requesting webservice methods of the WaterOneFlow interface. E.g. it can be
-                    seen when downloading data from this project over the CUAHSI-Applications.
-                </div>
-            </div>
-            <div class="row form-group">
-				<div class="col-sm-offset-2 col-sm-1">
-					<div id="btn-edit" class="btn btn-default">Edit</div>
-                    <button id="btn-save" type="submit"
-                    class="btn btn-success" style="display: none;">Save</button>
-                    <input type="hidden" id="project_id" name="project_id" value="${project.id}" />
-				</div>
-            </div>
-		</form>
-				<div class="col-sm-2">
-				<form method="post" action="${conf.root_url}/project/delete" style="display: inline;">
-					<button id="btn-delete" type="submit"
-					class="btn btn-danger" style="display: none;">Delete</button>
-					<input type="hidden" id="project_id" name="project_id" value="${project.id}" />
-				</form>
-				<button id="btn-cancel" class="btn" style="display: none;">Cancel</button>
-		</div>
-
-	</div>
-
-	<script src="${conf.root_url}/media/lib/jquery-3.4.1.min.js" type="text/javascript" />
-	<script>
-		$(document).ready(function(){
-
-			// Event Handler
-
-			/*
-		     * This function provides the unlocking of the project form
-			 */
-			$('#btn-edit').click(function() {
-
-                $('#btn-edit').hide();
-                $('#btn-delete').show();
-                $('#btn-save').show();
-				$('#btn-cancel').show();
-
-				// Make the form writeable
-                $('#name').attr('readonly', false);
-                $('#person').attr('readonly', false);
-				$('#person').attr('disabled', false);
-				$('#person').show()
-                $('#person_link').hide()
-                $('#comment').attr('readonly', false);
-
-			});
-
-			$('#btn-cancel').click(function() {
-
-				$('#btn-save').hide();
-				$('#btn-delete').hide();
-				$('#btn-edit').show();
-
-
-				// Make the form readonly
-                $('#name').attr('readonly', true);
-                $('#person').attr('readonly', true);
-				$('#person').attr('disabled', true);
-                $('#person').hide()
-                $('#person_link').show()
-                $('#comment').attr('readonly', true);
-
-				$('#btn-cancel').hide();
-			});
-		})
-
-
-	</script>
-</body>
-</html>
\ No newline at end of file
diff --git a/odmf/static/templates/project_new.html b/odmf/static/templates/project_new.html
deleted file mode 100644
index cbb61c88..00000000
--- a/odmf/static/templates/project_new.html
+++ /dev/null
@@ -1,89 +0,0 @@
-<!DOCTYPE html>
-<html>
-
-<head>
-    <!-- Server configuration, see conf.py for HEAD_BASE -->
-    <script>function odmf_ref(s) {return '${conf.root_url}' + s;}</script>
-
-	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" integrity="sha512-dTfge/zgoMYpP7QbHy4gWMEGsbsdZeCXz7irItjcC3sPUFtf0kuFbDz/ixG7ArTxmDjLXDmezHubeNikyKGVyQ==" crossorigin="anonymous" />
-
-	<link href="${conf.root_url}/media/css/odmf.css" rel="stylesheet" type="text/css"/>
-	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-	<title>Projects</title>
-</head>
-<style>
-	.form-horizontal {
-		padding: 15px;
-	}
-
-	div.space {
-		margin-top: 10px;
-		margin-bottom: 5px;
-	}
-	div.short {
-		width: 40em;
-	}
-
-    /*<!-- Only for the note --> */
-    #commentnote > div.col-sm-8 {
-        margin-top:1.5rem;
-    }
-
-    /*Fix Bootstrap overwride*/
-    body {
-        line-height: normal;
-    }
-</style>
-<body>
-	${navigation('New project')}
-	<div class="content">
-        <div class="error" py:content="error" />
-		<a href="${conf.root_url}/project">Back to all project</a>
-		<form method="post" action="${conf.root_url}/project/save">
-            <div class="form-group">
-				<label for="name" class="col-sm-2 control-label">Name</label>
-				<div class="col-sm-10">
-					<input name="name" id="name" type="text" class="form-control"/>
-				</div>
-			</div>
-
-			<div class="form-group">
-				<label for="person"
-					   class="col-sm-2 control-label">Person responsible</label>
-				<div class="col-sm-10">
-					<select name="person" id="person" class="form-control">
-						<option py:for="p in persons" value="${p.username}" py:content="p" />
-					</select>
-				</div>
-			</div>
-
-			<div class="form-group">
-				<label for="comment" class="col-sm-2 control-label">Comment</label><br/>
-				<div class="col-sm-10">
-                    <textarea name="comment" id="comment" class="form-control"
-                        placeholder="Can be seen when downloading data of this project from the CUAHSI webinterface"></textarea>
-                </div>
-
-			</div>
-
-            <!-- Comment -->
-            <div id="commentnote" class="row from-group">
-                <div class="col-sm-8 col-sm-offset-2">
-                    <strong>Note:</strong> The comment is a description, which is part of the reponse, when
-                    requesting webservice methods of the <a href="${conf.root_url}/wof">WaterOneFlow interface</a>. E.g. it can be
-                    seen when downloading data from this project over the CUAHSI-Applications.
-                </div>
-            </div>
-
-            <div class="form-group">
-				<div class="col-sm-2">
-                    <button type="submit" name="save" value="Save" class="btn btn-success">Save</button>
-				</div>
-            </div>
-
-		</form>
-
-	</div>
-
-</body>
-</html>
\ No newline at end of file
diff --git a/odmf/static/templates/projects.html b/odmf/static/templates/projects.html
deleted file mode 100644
index 54b0d29c..00000000
--- a/odmf/static/templates/projects.html
+++ /dev/null
@@ -1,84 +0,0 @@
-<!DOCTYPE html>
-<html>
-
-<head>
-    <!-- Server configuration, see conf.py for HEAD_BASE -->
-    <script>function odmf_ref(s) {return '${conf.root_url}' + s;}</script>
-
-	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css"
-          integrity="sha512-dTfge/zgoMYpP7QbHy4gWMEGsbsdZeCXz7irItjcC3sPUFtf0kuFbDz/ixG7ArTxmDjLXDmezHubeNikyKGVyQ=="
-          crossorigin="anonymous" />
-
-	<link href="${conf.root_url}/media/css/odmf.css" rel="stylesheet" type="text/css"/>
-
-	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-	<title>Projects</title>
-
-</head>
-<style>
-	a.button {
-		color: #000;
-	}
-	/*textarea {
-		min-width: 100%;
-	}
-	tr.fullwindow {
-		font-size: small;
-		border-bottom: solid 1px #888;
-		cursor: pointer;
-	}
-	tr.fullwindow>td {
-		border: dotted 1px #888;
-	}
-	tr.fullwindow:hover {
-		outline: solid 4px white;
-	}
-	table {
-		width: 100%;
-	}
-    */
-	div.space {
-		margin-top: 10px;
-		margin-bottom: 5px;
-	}
-	div.short {
-		width: 40em;
-	}
-	input {
-		width: 100%;
-	}
-    /*Fix Bootstrap overwride*/
-    body {
-        line-height: normal;
-    }
-</style>
-<body>
-	${navigation('Projects')}
-	<div class="content">
-		<div class="error" py:content="error" />
-		<table class="table table-condensed table-striped">
-			<tr>
-				<th>#</th>
-				<th>Name</th>
-				<th>Person responsible</th>
-			</tr>
-			<tr>
-				<td></td>
-				<td></td>
-				<td><input type="text" class="form-control" placeholder="Search"/></td>
-			</tr>
-			<tr py:for="p in projects">
-				<td>${p.id}</td>
-				<td><a href="${conf.root_url}/project/${p.id}">${p.name}</a></td>
-				<td><a href="user/${p.person_responsible.username}">${p.person_responsible}</a></td>
-			</tr>
-			<tr py:if="is_member('supervisor')" class="active">
-				<td><a class="btn btn-default" href="project/add">Add project</a></td>
-				<td></td>
-				<td></td>
-			</tr>
-		</table>
-	</div>
-
-</body>
-</html>
\ No newline at end of file
diff --git a/odmf/static/templates/site.html b/odmf/static/templates/site.html
index f568f376..d321ef52 100644
--- a/odmf/static/templates/site.html
+++ b/odmf/static/templates/site.html
@@ -315,7 +315,7 @@ <h1 class="mt-2 bg-dark text-white">Installations</h1>
                             </a>
                         </li>
                         <li py:for="ds in datasets">
-                            <a href="${conf.root_url}/dataset/${ds.id}?site_id=${actualsite.id}"
+                            <a href="${conf.root_url}/dataset/${ds.id}"
                                py:content="ds" />
                         </li>
                     </ul>
diff --git a/odmf/tools/__init__.py b/odmf/tools/__init__.py
index 4480542d..8bd30c03 100644
--- a/odmf/tools/__init__.py
+++ b/odmf/tools/__init__.py
@@ -5,15 +5,20 @@
 import typing
 import bcrypt
 from ..config import conf
+import pathlib
 
 __all__ = ['mail', 'Path']
 
 
 class Path(object):
-    def __init__(self, *path: str):
+    def __init__(self, *path: str|Path|pathlib.Path, absolute=False):
         self.datapath = op.realpath(conf.datafiles)
         if path:
-            if str(path[0]).startswith('/'):
+            if type(path[0]) is pathlib.Path:
+                self.absolute = str(path[0].absolute())
+            elif type(path[0]) is Path:
+                self.absolute = path[0].absolute
+            elif str(path[0]).startswith('/') or absolute:
                 self.absolute = op.realpath(op.join(*path))
             else:
                 self.absolute = op.realpath(op.join(self.datapath, *path))
@@ -22,6 +27,9 @@ def __init__(self, *path: str):
             self.absolute = self.datapath
             self.name = '/'
 
+    def __hash__(self):
+        return hash(self.datapath)
+
     @property
     def basename(self)->str:
         return op.basename(self.absolute)
@@ -47,6 +55,9 @@ def __bool__(self):
     def __str__(self):
         return self.name
 
+    def __repr__(self):
+        return f"odmf.tools.Path('{self.name}')"
+
     def formatsize(self)->str:
         size = op.getsize(self.absolute)
         unit = 0
@@ -75,10 +86,13 @@ def __gt__(self, other):
     def __add__(self, fn):
         return Path(op.join(self.absolute, fn))
 
+    def __truediv__(self, fn):
+        return Path(op.join(self.absolute, fn))
+
     def make(self):
         os.makedirs(self.absolute, mode=0o770)
 
-    def breadcrumbs(self) -> list[str]:
+    def breadcrumbs(self) -> list[Path]:
         res = [self]
         p = op.dirname(self.absolute)
         while self.datapath in p:
@@ -86,28 +100,28 @@ def breadcrumbs(self) -> list[str]:
             p = op.dirname(p)
         return res
 
-    def child(self, filename):
+    def child(self, filename) -> Path:
         return Path(op.join(self.absolute, filename))
 
-    def isdir(self):
+    def isdir(self) -> bool:
         return op.isdir(self.absolute)
 
-    def isroot(self):
+    def isroot(self) -> bool:
         return self.absolute == self.datapath
 
-    def isfile(self):
+    def isfile(self) -> bool:
         return op.isfile(self.absolute)
 
-    def exists(self):
+    def exists(self) -> bool:
         return op.exists(self.absolute)
 
-    def parent(self):
+    def parent(self) -> Path:
         return Path(op.dirname(self.absolute))
 
     def ishidden(self):
         return self.basename.startswith('.') or self.basename == 'index.html'
 
-    def listdir(self) -> (typing.List[Path], typing.List[Path]):
+    def listdir(self, hidden=False) -> (typing.List[Path], typing.List[Path]):
         """
         Lists all members of the path in
         2 lists:
@@ -119,17 +133,22 @@ def listdir(self) -> (typing.List[Path], typing.List[Path]):
         files = []
         directories = []
         if self.isdir() and self.islegal():
-            for fn in os.listdir(self.absolute):
-                if not fn.startswith('.'):
-                    child = self.child(fn)
-                    if child.isdir():
-                        directories.append(child)
-                    elif child.isfile():
-                        files.append(child)
+            for child in self.iterdir(hidden):
+                if child.isdir():
+                    directories.append(child)
+                elif child.isfile():
+                    files.append(child)
             return directories, files
         else:
             return [], []
 
+    def iterdir(self, hidden=False) -> typing.Generator[Path]:
+        if self.isdir() and self.islegal():
+            for fn in os.listdir(self.absolute):
+                if hidden or not fn.startswith('.'):
+                    yield self.child(fn)
+
+
     def isempty(self) -> bool:
         """
         Returns True, if self isdir and has no entries
@@ -146,6 +165,13 @@ def up(self) -> str:
     def delete(self):
         os.unlink(self.absolute)
 
+    def to_pythonpath(self) -> pathlib.Path:
+        return pathlib.Path(self.absolute)
+
+    @classmethod
+    def from_pythonpath(cls, pypath: pathlib.Path):
+        return cls(str(pypath.absolute()), absolute=True)
+
 
 def hashpw(password, salt=None):
     """
diff --git a/odmf/tools/migrate_db.py b/odmf/tools/migrate_db.py
index dc92ffe7..c58bfcd5 100644
--- a/odmf/tools/migrate_db.py
+++ b/odmf/tools/migrate_db.py
@@ -25,8 +25,8 @@ def add_column(self, table: str, column: str, type: SqlTypeEngine, constraint=''
             logger.info(f'added {table}.{column}')
 
     def run(self):
-        # self.add_column('project', 'organization', sql.String(), "default 'uni-giessen.de'")
-        # self.add_column('project', 'sourcelink', sql.String())
+        self.add_column('project', 'organization', sql.String(), "default 'uni-giessen.de'")
+        self.add_column('project', 'sourcelink', sql.String())
         logger.info('migration complete')
 
     def ___run_all(self):
diff --git a/odmf/tools/parquet_import.py b/odmf/tools/parquet_import.py
index 7ba9dfae..fc0f6dfc 100644
--- a/odmf/tools/parquet_import.py
+++ b/odmf/tools/parquet_import.py
@@ -72,7 +72,7 @@ def addrecords_parquet(filename):
     Expects a table in the apache arrow format to import records to existing datasets. Expected column names:
     dataset, id, time, value [,sample, comment, is_error]
     """
-
+    from ..webpage.auth import users
     # Load dataframe
     df = pd.read_parquet(filename)
     df = df[~df.value.isna()]
@@ -86,6 +86,16 @@ def addrecords_parquet(filename):
         datasets = session.query(db.Dataset).filter(db.Dataset.id.in_(ds_ids)).order_by(db.Dataset.id)
 
         # Alter id and timeranges
+        error_ds = [
+            ds.id
+            for ds in datasets
+            if ds.access > ds.get_access_level(users.current)
+        ]
+
+        if error_ds:
+            error_ds = ', '.join(f'ds{ds.id}' for ds in error_ds)
+            raise ValueError(f'{users.current} may not append to datasets {error_ds}')
+
         for ds in datasets:
             _adjust_id(df, ds)
             _adjust_time(df, ds)
diff --git a/odmf/tools/server.py b/odmf/tools/server.py
index dc04c2d9..8ddbfdaa 100644
--- a/odmf/tools/server.py
+++ b/odmf/tools/server.py
@@ -7,7 +7,7 @@
 from logging import getLogger
 import os
 import sys
-from ..webpage import expose_for
+from ..webpage.auth import expose_for
 
 logger = getLogger(__name__)
 server_config = {
diff --git a/odmf/webpage/__init__.py b/odmf/webpage/__init__.py
index c1ad29e1..2c0485b1 100644
--- a/odmf/webpage/__init__.py
+++ b/odmf/webpage/__init__.py
@@ -1,5 +1,4 @@
 # -*- coding:utf-8 -*-
 
-from .root import *
-from .auth import users, require, member_of, has_level
-from .lib import renderer
+
+
diff --git a/odmf/webpage/api/dataset_api.py b/odmf/webpage/api/dataset_api.py
index d5f4151b..2b7673e9 100644
--- a/odmf/webpage/api/dataset_api.py
+++ b/odmf/webpage/api/dataset_api.py
@@ -8,7 +8,7 @@
 import pandas as pd
 
 from .. import lib as web
-from ..auth import users, expose_for, group, has_level
+from ..auth import users, expose_for, has_level, Level
 from ... import db
 from ...config import conf
 from . import BaseAPI, get_help
@@ -57,12 +57,12 @@ def get_dataset(dsid: str, check_access=True) -> db.Dataset:
             ds = session.query(db.Dataset).get(dsid)
             if not ds:
                 raise web.APIError(404, f'ds{dsid} does not exist')
-            elif check_access and not has_level(ds.access):
+            elif check_access and ds.access > ds.get_access_level(users.current):
                 raise web.APIError(403, f'ds{dsid} is protected. Need a higher access level')
             else:
                 yield ds
 
-    @expose_for(group.guest)
+    @expose_for(Level.guest)
     @web.method.get
     def index(self, dsid=None):
         """
@@ -75,10 +75,10 @@ def index(self, dsid=None):
             url, res = get_help(self, self.url)
             res[f'{self.url}/[n]'] = f"A dataset with the id [n]. See {self.url}/list method"
             return web.json_out(res)
-        with self.get_dataset(dsid, False) as ds:
+        with self.get_dataset(dsid, check_access=False) as ds:
             return web.json_out(ds)
 
-    @expose_for(group.guest)
+    @expose_for(Level.guest)
     @web.mime.json
     def records(self, dsid):
         """
@@ -87,7 +87,7 @@ def records(self, dsid):
         with self.get_dataset(dsid) as ds:
             return web.json_out(ds.records.all())
 
-    @expose_for(group.guest)
+    @expose_for(Level.guest)
     def values(self, dsid, start=None, end=None):
         """
         NOT TESTED! Returns the calibrated values for a dataset
@@ -97,13 +97,13 @@ def values(self, dsid, start=None, end=None):
         :return: JSON list of time/value pairs
         """
         web.mime.json.set()
-        start = web.parsedate(start, False)
-        end = web.parsedate(end, False)
+        start = web.parsedate(start, raiseerror=False)
+        end = web.parsedate(end, raiseerror=False)
         with self.get_dataset(dsid) as ds:
             series = ds.asseries(start, end)
             return series.to_json().encode('utf-8')
 
-    @expose_for(group.guest)
+    @expose_for(Level.guest)
     @web.method.get
     def values_parquet(self, dsid, start=None, end=None):
         """
@@ -147,7 +147,7 @@ def list(
                 for ds in datasets
             ])
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def new(self, **kwargs):
         """
@@ -210,7 +210,7 @@ def new(self, **kwargs):
                 # On error render the error message
                 raise web.APIError(400, 'Creating new timeseries failed') from e
 
-    @expose_for(group.admin)
+    @expose_for(Level.admin)
     @web.method.post_or_delete
     def delete(self, dsid: int):
         with db.session_scope() as session:
@@ -221,7 +221,7 @@ def delete(self, dsid: int):
             session.delete(ds)
             return web.json_out(dict(status='success', datasets=[dsid]))
 
-    @expose_for(group.guest)
+    @expose_for(Level.guest)
     @web.method.get
     def count_records(self, dsid: int):
         web.mime.plain.set()
@@ -231,7 +231,7 @@ def count_records(self, dsid: int):
             return f'{ds.size()}'.encode('utf-8')
 
 
-    @expose_for(group.admin)
+    @expose_for(Level.admin)
     @web.method.post_or_delete
     def delete_records(self, dsid: int, start=None, end=None):
         """
@@ -241,6 +241,8 @@ def delete_records(self, dsid: int, start=None, end=None):
         with db.session_scope() as session:
             if not (ds := session.query(db.Timeseries).get(dsid)):
                 raise web.APIError(404, f'Dataset {dsid} not found')
+            if ds.access > ds.get_access_level(users.current):
+                raise web.APIError(403, 'Not enough privileges')
             records = ds.records
             if start:
                start = web.parsedate(start)
@@ -253,7 +255,7 @@ def delete_records(self, dsid: int, start=None, end=None):
             return f'{count} records deleted'.encode('utf-8')
 
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def addrecord(self, dsid: int, value: float, time: str,
                   sample: str = None, comment: str = None, recid: int = None):
@@ -275,6 +277,9 @@ def addrecord(self, dsid: int, value: float, time: str,
             try:
                 dsid = self.parse_id(dsid)
                 ds = session.query(db.Timeseries).get(dsid)
+                if ds.access > ds.get_access_level(users.current):
+                    raise web.APIError(403, 'Not enough privileges')
+
                 if not ds:
                     return 'Timeseries ds:{} does not exist'.format(dsid)
                 new_rec = ds.addrecord(Id=recid, time=time, value=value, comment=comment, sample=sample)
@@ -282,7 +287,7 @@ def addrecord(self, dsid: int, value: float, time: str,
             except Exception as e:
                 raise web.APIError(400, 'Could not add record') from e
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def addrecords_parquet(self):
         """
@@ -299,7 +304,7 @@ def addrecords_parquet(self):
         return web.json_out(dict(status='success', datasets=list(datasets), records=records))
 
     @web.json_in()
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def addrecords_json(self):
         """
@@ -332,6 +337,10 @@ def addrecords_json(self):
                     ...  # reuse last dataset
                 if not dataset:
                     warnings.append(f'ds{dsid} does not exist')
+                    continue
+                elif dataset.access > dataset.get_access_level(users.current):
+                    warnings.append(f'ds{dsid} forbidden to append data for {users.current}')
+                    continue
                 # get value, time, sample, comment and recid
                 value = web.conv(float, rec.get('value'))
                 time = web.parsedate(rec.get('time'), False)
diff --git a/odmf/webpage/auth.py b/odmf/webpage/auth.py
index 5e233dfc..38450850 100644
--- a/odmf/webpage/auth.py
+++ b/odmf/webpage/auth.py
@@ -8,38 +8,15 @@
 
 import os.path as op
 import collections
+import typing
 
 import cherrypy
 
 from ..tools import hashpw, get_bcrypt_salt
-
-ACCESS_LEVELS = [["Guest", "0"],
-                 ["Logger", "1"],
-                 ["Editor", "2"],
-                 ["Supervisor", "3"],
-                 ["Admin", "4"]]
-
-
-def levels_supervisor():
-    return levels_admin()[:2]
-
-
-def levels_admin():
-    return ACCESS_LEVELS[1:5]
-
-
-def get_levels(level):
-    if level == int(ACCESS_LEVELS[3][1]):
-        return levels_supervisor()
-    elif level == int(ACCESS_LEVELS[4][1]):
-        return levels_admin()
-    else:
-        return ACCESS_LEVELS
-
+from enum import IntEnum
 
 SESSION_KEY = '#!35625/Schwingbach?Benutzer'
 
-
 def sessionuser()->str:
     "Returns the username saved in the session"
     return cherrypy.session.get(SESSION_KEY)
@@ -94,30 +71,57 @@ class group:
     supervisor = 'supervisor'
     admin = 'admin'
 
+class Level(IntEnum):
+    guest = 0
+    logger = 1
+    editor = 2
+    supervisor = 3
+    admin = 4
+
+    @staticmethod
+    def my(project=None):
+        """
+        Returns the level of the current user
+        """
+        if users.current:
+            return users.current.get_level(project)
+        else:
+            return Level.guest
 
-class User(object):
-    groups = ('guest', 'logger', 'editor', 'supervisor', 'admin')
 
-    @classmethod
-    def __level_to_group(cls, level):
-        if level >= 0 and level < len(User.groups):
-            return User.groups[level]
-        else:
-            return "Unknown level %i" % level
+class User(object):
 
-    def __init__(self, name, level, password):
+    def __init__(self, name, level, password, projects=None):
         self.name = name
-        self.level = int(level)
+        self.level = Level(level)
         self.password = password
         self.person = None
+        self.projects: typing.Dict[int, Level] = projects or {}
 
     @property
-    def group(self):
-        return User.__level_to_group(self.level)
+    def group(self) -> str:
+        return self.level.name
+
+    def is_member(self, level: Level|str|int, project:int=None) -> bool:
+        if type(level) is str:
+            level=Level[level]
+        else:
+            level = Level(level or 0)
+        return self.get_level(project) >= level
+
+    def get_level(self, project: int|None = None) -> Level:
+        """
+        Returns the level of this user. If a project is given, return the level for that project
+        :param project: int (project-id) or db.Project
+        :return:
+        """
+        if project is None or self.level>=Level.admin:
+            return self.level
+        else:
+            if hasattr(project, 'id'):
+                project = project.id
+            return self.projects.get(project, Level.guest)
 
-    def is_member(self, group):
-        grouplevel = User.groups.index(group)
-        return self.level >= grouplevel
 
     def check(self, password):
 
@@ -153,7 +157,10 @@ def load(self):
             q = session.query(db.Person).filter(db.Person.active == True)
 
             self.data = {
-                person.username: User(person.username, person.access_level, person.password)
+                person.username: User(
+                    person.username, person.access_level, person.password,
+                    projects={project.id: Level(l) for project, l in person.projects()}
+                )
                 for person in q
             }
 
@@ -207,8 +214,8 @@ def logout(self):
 
 
 
-def is_member(group):
-    return bool(users.current) and users.current.is_member(group)
+def is_member(level: Level|str, project=None):
+    return bool(users.current) and users.current.is_member(level, project)
 
 
 def require(*conditions):
@@ -225,17 +232,17 @@ def decorate(f):
     return decorate
 
 
-def member_of(groupname):
+def member_of(level: Level|str|int, project: int = None):
     def check():
         user = users.current
-        return user and user.is_member(groupname)
+        return user and user.is_member(level, project)
     return check
 
 
 def has_level(level):
     def check():
         user = users.current
-        return user and user.level >= int(level)
+        return user and user.level >= Level(level)
     return check
 
 
@@ -243,9 +250,10 @@ def expose_for(groupname=None):
     def decorate(f):
         if not hasattr(f, '_cp_config'):
             f._cp_config = {}
-        if groupname:
+        else:
             f._cp_config.setdefault('auth.require', []).append(
-                member_of(groupname))
+                member_of(groupname)
+            )
         f.exposed = True
         f.level = groupname
         return f
diff --git a/odmf/webpage/db_editor/datasetpage.py b/odmf/webpage/db_editor/datasetpage.py
index a8627c44..ee2f9e32 100644
--- a/odmf/webpage/db_editor/datasetpage.py
+++ b/odmf/webpage/db_editor/datasetpage.py
@@ -9,7 +9,7 @@
 from traceback import format_exc as traceback
 from datetime import datetime, timedelta
 import io
-from ..auth import group, expose_for, users
+from ..auth import Level, expose_for, users
 import codecs
 from ...tools.calibration import Calibration, CalibrationSource
 from ...config import conf
@@ -17,6 +17,17 @@
 import cherrypy
 
 
+def get_ds(session, datasetid):
+    """
+    Gets a dataset from an id
+    """
+    return session.query(db.Dataset).get(int(datasetid))
+
+
+def has_access(ds: db.Dataset, level:Level=Level.guest):
+    return ds.get_access_level(users.current) >= max(ds.access, level)
+
+@cherrypy.popargs('datasetid')
 @web.show_in_nav_for(1, icon='clipboard')
 class DatasetPage:
     """
@@ -24,123 +35,96 @@ class DatasetPage:
     """
     exposed = True
 
-    @expose_for(group.logger)
-    @web.method.get
-    def index(self, error='', message=None):
-        """
-        Returns the query page (datasetlist.html). Site logic is handled with ajax
-        """
-        return web.render('datasetlist.html', error=error, message=message).render()
 
-    @expose_for(group.guest)
+    @expose_for()
     @web.method.get
-    def default(self, id='new', site_id=None, vt_id=None, user=None, error='', _=None):
+    def index(self, datasetid=None, error='', message=None):
         """
-        Returns the dataset view and manipulation page (dataset-edit.html).
-        Expects an valid dataset id, 'new' or 'last'. With new, a new dataset
-        is created, if 'last' the last chosen dataset is taken   
+        Returns the query page (datasetlist.html). Site logic is handled with ajax
         """
-        if id == 'last':
-            # get the last viewed dataset from web-session. If there is no
-            # last dataset, redirect to index
-            id = web.cherrypy.session.get('dataset')  # @UndefinedVariable
-            if id is None:
-                raise web.redirect(conf.root_url + '/dataset/')
+        if datasetid is None:
+            return web.render('datasetlist.html', error=error, message=message).render()
+        else:
+            with db.session_scope() as session:
+                active = get_ds(session, datasetid)
+                if active:  # save requested dataset as 'last'
+                    web.cherrypy.session['dataset'] = datasetid  # @UndefinedVariable
+                    return self.render_dataset(active, error, message)
+                else:
+                    raise web.redirect(conf.root_url + '/dataset', error=f'No ds{id} available')
+    @expose_for(Level.editor)
+    def new(self, site_id=None, vt_id=None, user=None, error='', _=None):
         with db.session_scope() as session:
 
             site = session.query(db.Site).get(site_id) if site_id else None
-            valuetype = session.query(db.ValueType).get(
-                vt_id) if vt_id else None
+            valuetype = session.query(db.ValueType).get(vt_id) if vt_id else None
             # All projects
 
             if user is None:
                 user = web.user()
             user: db.Person = session.query(db.Person).get(user) if user else None
-            if id == 'new':
-                active = db.Timeseries(
-                    id=db.newid(db.Dataset, session),
-                    name='New Dataset',
-                    site=site,
-                    valuetype=valuetype,
-                    measured_by=user,
-                    access=user.access_level
-                )
-            else:  # Else load requested dataset
-                active = session.query(db.Dataset).get(int(id))
-
-                if active:  # save requested dataset as 'last'
-                    web.cherrypy.session['dataset'] = id  # @UndefinedVariable
-                else:
-                    raise web.redirect(conf.root_url + '/dataset', error=f'No ds{id} available')
-
-            # Setting the project, for editing and ui navigation
-            if active.project is not None:
-                project = session.query(db.Project).get(int(active.project))
-            else:
-                project = None
-
-            datasets = {
-                "same type": [],
-                "same time": [],
-            }
-
-            try:
-                # load data for dataset-edit.html:
-                # similar datasets (same site and same type)
-                if active.valuetype and active.site:
-                    similar_datasets = self.subset(session, valuetype=active.valuetype.id,
-                                                   site=active.site.id).filter(db.Dataset.id != active.id)
-                else:
-                    similar_datasets = []
-                # parallel dataset (same site and same time, different type)
-                if active.site and active.start and active.end:
-                    parallel_datasets = session.query(db.Dataset).filter_by(site=active.site).filter(
-                        db.Dataset.start <= active.end, db.Dataset.end >= active.start).filter(db.Dataset.id != active.id)
-                else:
-                    parallel_datasets = []
-
-                datasets = {
-                    "same type": similar_datasets,
-                    "same time": parallel_datasets,
-                }
-            except Exception as e:
-                # If loading fails, don't show similar datasets
-                error += str(e)
-
-            # Render the resulting page
-            return web.render(
-                'dataset-edit.html',
-                # activedataset is the current dataset (id or new)
-                ds_act=active, n=active.size() if active else 0,
-                # Render error messages
-                error=error,
-                # similar and parallel datasets
-                datasets=datasets,
-                # The project
-                activeproject=project,
-                # All available timezones
-                timezones=common_timezones + ['Fixed/60'],
-                # The title of the page
-                title='ds' + str(id),
-                # A couple of prepared queries to fill select elements
-                valuetypes=session.query(db.ValueType).order_by(db.ValueType.name),
-                persons=session.query(db.Person).order_by(db.Person.can_supervise.desc(), db.Person.surname),
-                sites=session.query(db.Site).order_by(db.Site.id),
-                quality=session.query(db.Quality).order_by(db.Quality.id),
-                datasources=session.query(db.Datasource),
-                projects=session.query(db.Project),
-            ).render()
-
-    @expose_for(group.editor)
+            active = db.Timeseries(
+                id=db.newid(db.Dataset, session),
+                name='New Dataset',
+                site=site,
+                valuetype=valuetype,
+                measured_by=user,
+                access=user.access_level
+            )
+            return self.render_dataset(active)
+    def render_dataset(self, active: db.Dataset, message='', error=''):
+        """
+        Returns the dataset view and manipulation page (dataset-edit.html).
+        Expects a valid dataset id, 'new' or 'last'. With new, a new dataset
+        is created, if 'last' the last chosen dataset is taken   
+        """
+        web.cherrypy.session['dataset'] = id  # @UndefinedVariable
+        session = active.session()
+
+        def access(level: Level=Level.guest):
+            return has_access(active, level)
+
+        # Render the resulting page
+        return web.render(
+            'dataset-edit.html',
+            # activedataset is the current dataset (id or new)
+            ds_act=active, n=active.size(), access=access,
+            # Render error messages
+            error=error,
+            # All available timezones
+            timezones=common_timezones + ['Fixed/60'],
+            # The title of the page
+            title=f'ds{active.id}',
+            # A couple of prepared queries to fill select elements
+            valuetypes=session.query(db.ValueType).order_by(db.ValueType.name),
+            persons=session.query(db.Person).order_by(db.Person.can_supervise.desc(), db.Person.surname),
+            sites=session.query(db.Site).order_by(db.Site.id),
+            quality=session.query(db.Quality).order_by(db.Quality.id),
+            datasources=session.query(db.Datasource),
+            projects=session.query(db.Project),
+            same_time_ds=self.parallel_datasets(active)
+        ).render()
+
+    @staticmethod
+    def parallel_datasets(active: db.Timeseries):
+        # parallel dataset (same site and same time, different type)
+        session = active.session()
+        if active.site and active.start and active.end:
+            return session.query(db.Dataset).filter_by(site=active.site).filter(
+                db.Dataset.start <= active.end, db.Dataset.end >= active.start).filter(db.Dataset.id != active.id)
+        else:
+            return []
+
+
+    @expose_for(Level.editor)
     @web.method.post
-    def saveitem(self, **kwargs):
+    def save(self, **kwargs):
         """
         Saves the changes for an edited dataset
         """
-        id = kwargs.get('id', '')
         try:
             # Get current dataset
-            id = web.conv(int, id, '')
+            id = web.conv(int, kwargs.get('id'), '')
         except:
             raise web.redirect(conf.root_url + f'/dataset/{id}', error=traceback())
         # if save button has been pressed for submitting the dataset
@@ -155,10 +139,12 @@ def saveitem(self, **kwargs):
                     src = session.query(db.Datasource).get(kwargs.get('source'))
 
                     # get the dataset
-                    ds = session.query(db.Dataset).get(int(id))
+                    ds = get_ds(session, id)
                     if not ds:
                         # If no ds with id exists, create a new one
                         ds = db.Timeseries(id=id)
+                    if not has_access(ds, Level.editor):
+                        raise web.HTTPError(403, 'No sufficient rights to alter dataset')
                     # Get properties from the keyword arguments kwargs
                     ds.site = s
                     ds.filename = kwargs.get('filename')
@@ -168,12 +154,9 @@ def saveitem(self, **kwargs):
                     ds.valuetype = vt
                     ds.quality = q
 
-                    # TODO: Is it necessary to protect this
-                    # of being modified by somebody who isn't a supervisor or higher?
-                    if kwargs.get('project') == '0':
-                        ds.project = None
-                    else:
-                        ds.project = kwargs.get('project')
+                    if ds.get_access_level(users.current) >= Level.admin:
+                        project = session.query(db.Project).get(kwargs.get('project'))
+                        ds.project = project
 
                     ds.timezone = kwargs.get('timezone')
 
@@ -204,17 +187,17 @@ def saveitem(self, **kwargs):
         elif 'new' in kwargs:
             id = 'new'
         # reload page
-        raise web.redirect(str(id))
+        raise web.redirect(conf.root_url + f'/dataset/{id}')
 
     @expose_for()
     @web.method.get
     @web.mime.json
-    def statistics(self, id):
+    def statistics(self, datasetid):
         """
         Returns a json file holding the statistics for the dataset (is loaded by page using ajax)
         """
         with db.session_scope() as session:
-            ds = session.query(db.Dataset).get(int(id))
+            ds = get_ds(session, datasetid)
             if ds:
                 # Get statistics
                 mean, std, n = ds.statistics()
@@ -224,21 +207,26 @@ def statistics(self, id):
                 # Return empty dataset statistics
                 return web.json_out(dict(mean=0, std=0, n=0))
 
-    @expose_for(group.admin)
+    @expose_for(Level.editor)
     @web.method.post_or_delete
-    def remove(self, dsid):
+    def remove(self, datasetid):
         """
         Removes a dataset. Called by javascript, page reload handled by client
         """
-        try:
-            db.removedataset(dsid)
-            return None
-        except Exception as e:
-            return str(e)
+        with db.session_scope() as session:
+            ds = get_ds(session, datasetid)
+            if has_access(ds, Level.admin):
+                try:
+                    db.removedataset(datasetid)
+                    return None
+                except Exception as e:
+                    return str(e)
+            else:
+                return f'Cannot remove {datasetid} - not admin or owner'
 
     def subset(self, session, valuetype=None, user=None,
                site=None, date=None, instrument=None,
-               dstype=None, level=None, onlyaccess=False) -> db.orm.Query:
+               dstype=None, level=None, onlyaccess=False, project=None) -> db.orm.Query:
         """
         A not exposed helper function to get a subset of available datasets using filter
         """
@@ -246,6 +234,8 @@ def subset(self, session, valuetype=None, user=None,
         if user:
             user = session.query(db.Person).get(user)
             datasets = datasets.filter_by(measured_by=user)
+        if project and project!='NaN':
+            datasets = datasets.filter_by(_project=int(project))
         if site and site!='NaN':
             site = session.query(db.Site).get(web.conv(int, site))
             datasets = datasets.filter_by(site=site)
@@ -273,38 +263,6 @@ def subset(self, session, valuetype=None, user=None,
             datasets = datasets.filter(lvl >= db.Dataset.access)
         return datasets
 
-    @expose_for()
-    @web.method.get
-    @web.mime.json
-    def attrjson(self, attribute, valuetype=None, user=None,
-                 site=None, date=None, instrument=None,
-                 dstype=None, level=None, onlyaccess=False):
-        """
-        Gets the attributes for a dataset filter. Returns json. Used for many filters using ajax.
-        e.g: Map filter, datasetlist, import etc.
-
-        TODO: This function is not very well scalable. If the number of datasets grows,
-        please use distinct to get the distinct sites / valuetypes etc.
-        """
-        if not hasattr(db.Dataset, attribute):
-            raise AttributeError("Dataset has no attribute '%s'" % attribute)
-        res = ''
-        with db.session_scope() as session:
-            # Get dataset for filter
-            datasets = self.subset(session, valuetype, user,
-                                   site, date, instrument,
-                                   dstype, level, onlyaccess)
-
-            # Make a set of the attribute items and cull out None elements
-            items = set(getattr(ds, attribute)
-                        for ds in datasets if ds is not None)
-
-            # Not reasonable second iteration for eliminating None elements
-            items = set(e for e in items if e)
-
-            # Convert object set to json
-            return web.json_out(sorted(items))
-
     @expose_for()
     @web.method.get
     @web.mime.json
@@ -315,7 +273,7 @@ def attributes(self, valuetype=None, user=None, site=None, date=None, instrument
 
         Should replace multiple calls to attrjson
         """
-        ds_attributes = ['valuetype', 'measured_by', 'site', 'source', 'type', 'level',
+        ds_attributes = ['project', 'valuetype', 'measured_by', 'site', 'source', 'type', 'level',
                          'uses_dst', 'timezone', 'project', 'quality']
         entities = {
             'level': db.Dataset.level,
@@ -326,15 +284,16 @@ def attributes(self, valuetype=None, user=None, site=None, date=None, instrument
             'type': db.Dataset.type,
             'uses_dst': db.Dataset.uses_dst,
             'timezone': db.Dataset.timezone,
-            'project': db.Dataset.project,
+            'project': db.Project,
             'quality': db.Quality
         }
         import time
 
         def untuple(obj):
             try:
-                return obj[0]
-            except TypeError:
+                obj_single, = obj
+                return obj_single
+            except (TypeError, ValueError):
                 return obj
 
         def get_entity(q, entity):
@@ -342,14 +301,13 @@ def get_entity(q, entity):
                 qq = sorted(q.join(entity).with_entities(entity).distinct())
             else:
                 qq = q.with_entities(entity).distinct().order_by(entity)
-            print(qq)
             return qq
 
         with db.session_scope() as session:
             # Get dataset for filter
             datasets = self.subset(session, valuetype, user,
                                    site, date, instrument,
-                                   dstype, level, onlyaccess)
+                                   dstype, level, onlyaccess, project)
             t = time.time()
             # This is not really working by now, don't understand with_entities completely
             result = {
@@ -367,14 +325,18 @@ def get_entity(q, entity):
     @web.mime.json
     def json(self, valuetype=None, user=None, site=None,
              date=None, instrument=None, dstype=None,
-             level=None, onlyaccess=False, limit=None, page=None):
+             level=None, project=None, onlyaccess=False, limit=None, page=None):
         """
         Gets a json file of available datasets with filter
         """
+        me =users.current
+        def ds_to_json_with_access(ds: db.Dataset):
+            return ds.__jdict__() | {'accesslevel': ds.get_access_level(me).name}
+
         with db.session_scope() as session:
             dataset_q = self.subset(
                 session, valuetype, user, site,
-                date, instrument, dstype, level, onlyaccess
+                date, instrument, dstype, level, onlyaccess, project
             ).order_by(db.Dataset.id)
             count = dataset_q.count()
             if limit:
@@ -383,14 +345,16 @@ def json(self, valuetype=None, user=None, site=None,
             if page:
                 dataset_q = dataset_q.offset((int(page) - 1) * int(limit))
 
+            datasets = [ds_to_json_with_access(ds) for ds in dataset_q]
+
             return web.json_out({
-                'datasets': dataset_q.all(),
+                'datasets': datasets,
                 'count': count,
                 'limit': limit,
                 'page': page
             })
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def updaterecorderror(self, dataset, records):
         """
@@ -403,7 +367,7 @@ def updaterecorderror(self, dataset, records):
             for r in q:
                 r.is_error = True
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def setsplit(self, datasetid, recordid):
         """
@@ -427,7 +391,7 @@ def setsplit(self, datasetid, recordid):
         except:
             return traceback()
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     @web.method.get
     @web.mime.csv
     def records_csv(self, dataset, raw=False):
@@ -456,7 +420,7 @@ def records_csv(self, dataset, raw=False):
             session.close()
             return st.getvalue()
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     @web.method.post
     def plot(self, id, start='', end='', marker='', line='-', color='k', interactive=False):
         """
@@ -538,7 +502,7 @@ def records_json(self, dataset,
                 raise web.HTTPError(500, traceback())
             return web.json_out({'error': None, 'data': records.all()})
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def records(self, dataset, mindate, maxdate, minvalue, maxvalue,
                 threshold=None, limit=None, offset=None):
@@ -583,7 +547,7 @@ def records(self, dataset, mindate, maxdate, minvalue, maxvalue,
                              action="/dataset/setsplit",
                              action_help=f'{conf.root_url}/download/wiki/dataset/split.wiki').render()
 
-    @expose_for(group.editor)
+    @expose_for(Level.logger)
     @web.method.post
     def add_record(self, dataset, time, value, id=None, sample=None, comment=None):
         """
@@ -597,13 +561,15 @@ def add_record(self, dataset, time, value, id=None, sample=None, comment=None):
         """
         with db.session_scope() as session:
             ds: db.Timeseries = session.query(db.Dataset).get(int(dataset))
+            if not has_access(ds, Level.editor):
+                raise web.HTTPError(403, 'Not allowed')
             time = web.parsedate(time)
             ds.addrecord(id, value, time, comment, sample, out_of_timescope_ok=True)
-        raise web.redirect(str(dataset) + '#records')
+        raise web.redirect(str(dataset) + '/#add-record', message='record added')
 
 
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.get
     @web.mime.png
     def plot_coverage(self, siteid):
@@ -639,7 +605,7 @@ def plot_coverage(self, siteid):
             fig.savefig(st, dpi=100)
         return st.getvalue()
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def create_transformation(self, sourceid):
         """
@@ -672,7 +638,7 @@ def create_transformation(self, sourceid):
             raise web.AJAXError(500, str(e))
         return '/dataset/%s' % id
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def transform_removesource(self, transid, sourceid):
         """
@@ -688,7 +654,7 @@ def transform_removesource(self, transid, sourceid):
         except Exception as e:
             return str(e)
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def transform_addsource(self, transid, sourceid):
         """
@@ -705,7 +671,7 @@ def transform_addsource(self, transid, sourceid):
             return str(e)
 
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.get
     @web.mime.json
     def calibration_source_info(self, targetid, sourceid=None, limit=None, max_source_count=100):
@@ -762,7 +728,7 @@ def calibration_source_info(self, targetid, sourceid=None, limit=None, max_sourc
                 result=result
             ).encode('utf-8')
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def apply_calibration(self, targetid, sourceid, slope, offset):
         """
diff --git a/odmf/webpage/db_editor/person.py b/odmf/webpage/db_editor/person.py
index 99423432..d4c7b04f 100644
--- a/odmf/webpage/db_editor/person.py
+++ b/odmf/webpage/db_editor/person.py
@@ -1,7 +1,7 @@
 import cherrypy
 
 from .. import lib as web
-from ..auth import users, group, expose_for, hashpw, is_self, get_levels, HTTPAuthError
+from ..auth import users, expose_for, hashpw, is_self, Level
 
 from ... import db
 from traceback import format_exc as traceback
@@ -10,7 +10,7 @@
 @web.show_in_nav_for(1, 'user')
 class PersonPage:
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     def default(self, act_user=None, error='', msg=''):
         with db.session_scope() as session:
             persons = session.query(db.Person).order_by(
@@ -45,17 +45,16 @@ def default(self, act_user=None, error='', msg=''):
                 error=error, message=msg,
                 jobs=jobs,
                 act_user=act_user,
-                levels=get_levels,
                 is_self=is_self
             ).render()
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     @web.method.post
     def saveitem(self, **kwargs):
         username = kwargs.get('username')
         error = ''
         msg = ''
-        if is_self(username) or users.current.level > 2:
+        if is_self(username) or users.current.level >= Level.admin:
             with db.session_scope() as session:
                 p_act = session.query(db.Person).filter_by(
                     username=username).first()
@@ -76,7 +75,7 @@ def saveitem(self, **kwargs):
                     p_act.active = False
 
                 # Simple Validation
-                if kwargs.get('password') and users.current.is_member('admin') or is_self(username):
+                if kwargs.get('password') and users.current.is_member(Level.admin) or is_self(username):
                     pw = kwargs['password']
                     pw2 = kwargs.get('password_verify')
                     if len(pw) < 8:
@@ -92,7 +91,7 @@ def saveitem(self, **kwargs):
                     p_act.access_level = acl
                 msg = f'{username} saved'
         else:
-            error=f'As a {users.current.group} user, you may only change your own values'
+            error=f'As a {users.current.Level.name} user, you may only change your own values'
 
         raise web.redirect(username, error=error, msg=msg)
 
diff --git a/odmf/webpage/db_editor/project.py b/odmf/webpage/db_editor/project.py
index 7915eaff..f6a0023b 100644
--- a/odmf/webpage/db_editor/project.py
+++ b/odmf/webpage/db_editor/project.py
@@ -1,158 +1,94 @@
 import cherrypy
 
 from .. import lib as web
-from ..auth import group, expose_for
+from ..auth import group, expose_for, users, Level
 
 from ... import db
 from ...config import conf
 
-@web.show_in_nav_for(1)
+@cherrypy.popargs('project_id')
+@web.show_in_nav_for(1, 'user-friends')
 class ProjectPage:
 
-    @expose_for(group.logger)
-    def default(self, project_id=None, error=None):
+    @expose_for()
+    def index(self, project_id=None, error=None, msg=None):
 
         with db.session_scope() as session:
+            projects = db.ObjectGetter(db.Project, session)
+            persons = db.ObjectGetter(db.Person, session)
+            supervisors = persons.q.filter(db.Person.access_level >= 3)
 
-            if project_id is not None and str(project_id).isdigit():
-                project_from_id = session.query(db.Project).get(project_id)
+            if project_id == 'new':
+                project_from_id = db.Project()
 
-                if project_from_id is None:
-
-                    error = 'Warning: There was an error with the id \'%s\'. ' \
-                            'Please choose a project out of the ' \
-                            'list!' % project_id
-                    res = self.render_projects(session, error)
-
-                else:
-                    persons = session.query(db.Person)
-                    persons = persons.filter(db.Person.access_level > 3)
-
-                    error = ''
-
-                    res = web.render('project_from_id.html',
-                                     project=project_from_id,
-                                     persons=persons, error=error) \
-                        .render()
             elif project_id is None:
-
-                res = self.render_projects(session, error)
-
+                project_from_id = None
             else:
-                res = self.render_projects(session)
+                project_from_id = projects[int(project_id)]
 
-            return res
-
-    @expose_for(group.supervisor)
-    def add(self, error=''):
-
-        with db.session_scope() as session:
-            persons = session.query(db.Person)
-            persons = persons.filter(db.Person.access_level > 3)
-
-            res = web.render('project_new.html', persons=persons, error=error) \
+            return web.render('project.html',
+                              projects=projects.q.order_by(db.Project.id),
+                              actproject=project_from_id,
+                              supervisors=supervisors,
+                              persons=persons, error=error, msg=msg) \
                 .render()
 
-            return res
-
-    @expose_for(group.supervisor)
-    def save(self, **kwargs):
-
-        name = kwargs.get('name')
-        person = kwargs.get('person')
-        comment = kwargs.get('comment')
-
-        if not (name or person):
-            raise web.redirect(conf.root_url + '/project/add', error='Not all form fields were set')
-
-        with db.session_scope() as session:
-
-            person = session.query(db.Person).get(person)
 
-            if person is None:
-                raise RuntimeError(
-                    'Server Error. Please contact the Administrator')
+    @expose_for()
+    @web.method.post
+    def save(self, project_id:str, name:str, person:str, comment: str, sourcelink: str, organization: str):
+        error = ''
 
-            new_project = db.Project(
-                name=name, person_responsible=person, comment=comment)
+        project_id = int(project_id)
+        if Level.my(project_id) >= Level.admin:
+            try:
+                with db.session_scope() as session:
+                    if project_id:
+                        project = db.Project.get(session, project_id)
+                    else:
+                        project = db.Project()
+                        session.add(project)
 
-            session.add(new_project)
-            session.flush()
-
-            # For the user interface
-            persons = session.query(db.Person)
-            persons = persons.filter(db.Person.access_level > 3)
-
-            error = ''
-
-            res = web.render('project_from_id.html', project=new_project,
-                             persons=persons, error=error).render()
-
-        return res
-
-    @expose_for(group.supervisor)
-    def change(self, name=None, person=None, comment=None, project_id=None):
-
-        if (project_id is None) or (name is None) or (person is None):
-            raise web.HTTPError(500)
-
-        with db.session_scope() as session:
-
-            if str(project_id).isdigit():
-
-                project = session.query(db.Project).get(project_id)
-                person = session.query(db.Person).get(person)
-
-                # Update
-                project.name = name
-                project.person_responsible = person
-
-                if project.comment is not None:
+                    person = session.query(db.Person).get(person)
+                    project.name = name
                     project.comment = comment
+                    project.sourcelink = sourcelink
+                    project.organization = organization
+                    project.person_responsible = person
+                    if person is None:
+                        raise RuntimeError('Spokesperson not found')
+            except RuntimeError as e:
+                error = f'Save failed: {e}'
+            users.load()
+        else:
+            error = 'Not enough privileges to edit this project'
+        raise web.redirect(f'/{conf.root_url}project/{project_id}', error=error, msg=f'{name} updated' if not error else None)
 
-                # Render Webpage
-                persons = session.query(db.Person)
-                persons = persons.filter(db.Person.access_level > 3)
-
-                error = ''
-
-                res = web.render('project_from_id.html', project=project,
-                                 persons=persons, error=error).render('html',
-                                                                      doctype='html')
-
-            else:
-
-                error = 'There was a problem with the server'
-
-                res = self.render_projects(session, error)
-
-            return res
 
     @expose_for(group.supervisor)
-    def delete(self, project_id=None, force=None):
-
-        with db.session_scope() as session:
-
-            if str(force) == 'True':
-
-                project = session.query(db.Project).get(project_id)
-                session.delete(project)
-                # Returning to project
-                raise web.redirect(conf.root_url + '/project')
+    @web.method.post
+    def add_member(self, project_id, member_name, access_level):
+        error = None
+        try:
+            with db.session_scope() as session:
+                project = db.Project.get(session, project_id)
+                project.add_member(member_name, int(access_level))
+        except (RuntimeError, ValueError) as e:
+            error = f'### Save failed: \n\n{e}'
+        users.load()
+        raise web.redirect(f'/{conf.root_url}project/{project_id}', error=error, msg=f'{member_name} added' if not error else None)
 
-            else:
-                project = session.query(db.Project).get(project_id)
-                error = ''
-                return web.render('project_delete.html', project=project,
-                                 error=error).render()
-
-
-    def render_projects(self, session, error=''):
-
-        session.query(db.Project)
+    @expose_for(group.supervisor)
+    @web.method.post
+    def remove_member(self, project_id, member_name):
+        error = None
+        try:
+            with db.session_scope() as session:
+                project = db.Project.get(session, project_id)
+                project.remove_member(member_name)
+        except RuntimeError as e:
+            error = f'Save failed: {e}'
+        users.load()
+        raise web.redirect(f'/{conf.root_url}project/{project_id}', error=error, msg=f'{member_name} removed' if not error else None)
 
-        projects = session.query(db.Project)
-        projects = projects.order_by(db.sql.asc(db.Project.id))
 
-        return web.render('projects.html', error=error, projects=projects
-                          ).render()
diff --git a/odmf/webpage/filemanager/file_auth.py b/odmf/webpage/filemanager/file_auth.py
new file mode 100644
index 00000000..40f89eea
--- /dev/null
+++ b/odmf/webpage/filemanager/file_auth.py
@@ -0,0 +1,131 @@
+from .. import auth
+from ...tools import Path
+import yaml
+import dataclasses
+import typing
+from enum import IntFlag
+
+filename = '.access.yml'
+owner_file = '.owner'
+class Mode(IntFlag):
+    """
+    This flag shows what can be done with a file. Read only, read/write or admin rights
+    """
+    none = 0
+    read = 1
+    write = 3
+    admin = 7
+@dataclasses.dataclass
+class AccessRule:
+    """
+    Access files are hidden files to steer the access to a directory and its children. They are in yaml format
+    and contain a rule object. The rule properties are:
+
+    - owner: str the user name of the owner of this directory (admin access)
+    - write: int default 9, access level needed for write access
+    - read: bool default write, access level needed for read access
+    - projects: list[int] list of projects this rule relates to. If empty the global
+            access level of the user is taken
+
+    The site admin (user.level=4), the project admins and the directory owner have admin access (may delete files)
+
+    """
+
+    write: Mode = 0
+    read: Mode = 0
+    projects: list = dataclasses.field(default_factory=list)
+
+
+    def __call__(self, user: auth.User, owner:str = None) -> Mode:
+        """
+        Returns if a user has admin access 7, read/write access 3, read only access 1 or 0 for no access to this ressource
+        """
+        if user.level>=4 or user.name==owner:
+            return Mode.admin
+
+        if self.projects:
+            max_level = max([auth.Level.guest] + [user.projects[p] for p in self.projects if p in user.projects])
+        else:
+            max_level = user.level
+        if max_level >= auth.Level.admin:
+            return Mode.admin
+        elif max_level >= self.write:
+            return Mode.write
+        elif max_level >= self.read:
+            return Mode.read
+        else:
+            return Mode.none
+
+    def save(self, path: Path):
+        with open((path / filename).absolute, 'w') as f:
+            yaml.safe_dump(self.__dict__, f)
+
+    @classmethod
+    def from_file(cls, path: Path):
+        with open(path.absolute) as f:
+            content = yaml.safe_load(f)
+            return AccessRule(**content)
+
+    @classmethod
+    def find_rule(cls, path: Path):
+        for bc in reversed(path.breadcrumbs()):
+            if (yml := bc / filename).exists():
+                return AccessRule.from_file(yml)
+        else:
+            return AccessRule()
+
+def get_owner(path: Path) -> str|None:
+    """
+    Loads the owner of a directory. Returns the owner's user name or None if no owner present
+    """
+    path = Path(path)
+    for bc in reversed(path.breadcrumbs()):
+        if (fn := bc / owner_file).exists():
+            with open(fn.absolute) as f:
+                return f.read().strip()
+    else:
+        return None
+
+def set_owner(path: Path, owner: str):
+    with open((path / owner_file).absolute, 'w') as f:
+        f.write(owner)
+
+
+
+
+def check_directory(path: Path, user: auth.User) -> Mode:
+    """
+    Checks if a .access.yml file is in the directory path and applies the given user to the rules. If no .access.yml
+    file is present, the function looks into the parent directories and uses their access rule.
+    :param path:
+    :param user:
+    :return: 7: Admin access,
+    """
+    path = Path(path)
+    owner = get_owner(path)
+    rule = AccessRule.find_rule(path)
+    return rule(user, owner)
+
+def check_children(path: Path, user: auth.User) -> typing.Dict[Path, Mode]:
+    """
+    Checks the path like check_directory and all children directories for existing access rules. If rules are present,
+    the rules of the children are returned, else the rule of the parent
+    :param path: A path to a directory
+    :param user: A auth.User
+    :return: A dict[Path: int] containing for each path in [path, path/*] the accessibility value [7,3,1,0]
+    """
+    def check_child(p: Path):
+        if (yml:=p / filename).exists():
+            owner = get_owner(p)
+            return p, AccessRule.from_file(yml)(user, owner)
+        else:
+            return p, parent_mode
+    path = Path(path)
+    parent_mode = check_directory(path, user)
+    return {path: parent_mode} | dict(
+        check_child(f)
+        for f in path.iterdir()
+    )
+
+
+
diff --git a/odmf/webpage/filemanager/upload.py b/odmf/webpage/filemanager/upload.py
index 108c339d..67c849d2 100644
--- a/odmf/webpage/filemanager/upload.py
+++ b/odmf/webpage/filemanager/upload.py
@@ -15,13 +15,14 @@
 import cherrypy
 from cherrypy.lib.static import serve_file
 from urllib.parse import urlencode
-from ..auth import group, expose_for, is_member
+from ..auth import Level, expose_for, is_member, users
 from ...tools import Path
 
 from ...config import conf
 
 from .dbimport import DbImportPage
 from . import filehandlers as fh
+from . import file_auth as fa
 
 
 def write_to_file(dest, src):
@@ -49,13 +50,15 @@ def __init__(self, path: Path, status:int , message: str):
     def get_error_page(self, *args, **kwargs):
 
         error = f'Problem with {self.path}: {self.message}'
+        modes = fa.check_children(self.path, users.current)
 
         text = web.render(
             'download.html',
-            error=error, message='',
+            error=error, message='', modes=modes, Mode=fa.Mode,
             files=[],
             directories=[],
             curdir=self.path,
+            content='',
             max_size=conf.upload_max_size
         ).render()
 
@@ -72,7 +75,6 @@ def goto(dir, error=None, msg=None):
 
 
 
-
 @web.show_in_nav_for(0, 'file')
 class DownloadPage(object):
     """The file management system. Used to upload, import and find files"""
@@ -85,52 +87,66 @@ def _cp_dispatch(self, vpath: list):
     to_db = DbImportPage()
     filehandler = fh.MultiHandler()
 
-    @expose_for(group.logger)
+
+    def render_file(self, path, error=None):
+        content = ''
+        try:
+            content = self.filehandler(path)
+        except ValueError as e:
+            content = f'<div class="alert bg-warning"><h3>{e}</h3></div>'
+
+        except cherrypy.CherryPyException:
+            raise
+
+        except Exception as e:
+            if error: error += '\n\n'
+            error += str(e)
+            if is_member(Level.admin):
+                error += '\n```\n' + traceback() + '\n```\n'
+        return content, error
+
+
+    @expose_for(Level.logger)
     @web.method.get
     def index(self, uri='.', error='', msg='', serve=False, _=None):
         path = Path(uri)
-        directories, files = path.listdir()
-        content = ''
-        if path.isfile():
-            if (not serve):
-                try:
-                    content = self.filehandler(path)
-                except ValueError as e:
-                    content = f'<div class="alert bg-warning"><h3>{e}</h3></div>'
+        modes = fa.check_children(path, users.current)
 
-                except cherrypy.CherryPyException:
-                    raise
+        if not all((
+                path.islegal(),
+                path.exists(),
+        )):
+            raise HTTPFileNotFoundError(path)
+        hidden = (path.ishidden() and modes[path]<fa.Mode.admin) or modes[path]==fa.Mode.none
+        if hidden:
+            content = f'Forbidden access to resource {path} for {users.current.name}'
+            error = 'No access'
+            files = []
+            directories = []
+        else:
+            content = ''
+            directories, files = path.listdir(hidden=modes[path]>=fa.Mode.admin)
 
-                except Exception as e:
-                    if error : error += '\n\n'
-                    error += str(e)
-                    if is_member(group.admin):
-                        error += '\n```\n' + traceback() + '\n```\n'
-
-                return web.render(
-                    'download.html', error=error, message=msg,
-                    content=content, handler=self.filehandler,
-                    files=sorted(files),
-                    directories=sorted(directories),
-                    curdir=path,
-                    max_size=conf.upload_max_size
-                ).render()
-            else:
+        if path.isfile():
+            if serve:
                 return serve_file(path.absolute, disposition='attachment', name=path.basename)
+            else:
+                content, error = self.render_file(path, error)
 
-        elif not (path.islegal() and path.exists()):
-            raise HTTPFileNotFoundError(path)
-        else:
-            return web.render(
-                'download.html', error=error, message=msg,
-                files=sorted(files),
-                directories=sorted(directories),
-                handler = self.filehandler,
-                curdir=path,
-                max_size=conf.upload_max_size
-            ).render()
-
-    @expose_for(group.editor)
+        return web.render(
+            'download.html',
+            error=error, message=msg,
+            modes=modes, Mode=fa.Mode, owner=fa.get_owner(path),
+            content = content,
+            files=sorted(files),
+            directories=sorted(directories),
+            handler=self.filehandler,
+            curdir=path,
+            max_size=conf.upload_max_size
+        ).render()
+
+
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def upload(self, dir, datafiles, **kwargs):
         """
@@ -171,7 +187,7 @@ def upload(self, dir, datafiles, **kwargs):
 
         raise goto(dir, '\n'.join(error), '\n'.join(msg))
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     @web.method.post
     def saveindex(self, dir, s):
         """Saves the string s to index.html
@@ -181,14 +197,14 @@ def saveindex(self, dir, s):
         open(path.absolute, 'w').write(s)
         return web.markdown(s)
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     @web.method.get
     def getindex(self, dir):
-        index = Path(dir, 'index.html')
         io = StringIO()
-        if index.exists():
-            text = open(index.absolute).read()
-            io.write(text)
+        for indexfile in ['README.md', 'index.html']:
+            if (index:=Path(dir, indexfile)).exists():
+                text = open(index.absolute).read()
+                io.write(text)
 
         imphist = Path(dir, '.import.hist')
 
@@ -199,7 +215,7 @@ def getindex(self, dir):
                 io.write(f' * file:{dir}/{fn} imported by user:{user} at {date} into {ds}\n')
         return web.markdown(io.getvalue())
 
-    @expose_for(group.logger)
+    @expose_for(Level.logger)
     @web.method.get
     @web.mime.json
     def listdir(self, dir, pattern=None):
@@ -216,7 +232,7 @@ def listdir(self, dir, pattern=None):
             }
         ).encode('utf-8')
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def newfolder(self, dir, newfolder):
         error = ''
@@ -229,6 +245,7 @@ def newfolder(self, dir, newfolder):
                     path = Path(dir, newfolder)
                     if not path.exists() and path.islegal():
                         path.make()
+                        fa.set_owner(path, users.current.name)
                         msg = f"{path.href} created"
                     else:
                         error = f"Folder {newfolder} exists already"
@@ -242,12 +259,13 @@ def newfolder(self, dir, newfolder):
         else:
             raise goto(dir, error, msg)
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post_or_put
     def newtextfile(self, dir, newfilename):
         if newfilename:
             try:
                 path = Path(dir, newfilename)
+
                 if not path.basename.endswith('.wiki') or path.basename.endswith('.md'):
                     path = Path(str(path) + '.wiki')
                 if not path.exists() and path.islegal():
@@ -264,7 +282,7 @@ def newtextfile(self, dir, newfilename):
         else:
             raise goto(dir, error='Forgotten to give your new file a name?')
 
-    @expose_for(group.admin)
+    @expose_for(Level.editor)
     @web.method.post_or_delete
     def removefile(self, dir, filename):
         """
@@ -272,7 +290,9 @@ def removefile(self, dir, filename):
         """
         path = Path(dir, filename)
         error = msg = ''
-
+        mode = fa.check_directory(path, users.current)
+        if mode < fa.Mode.admin:
+            raise DownloadPageError(path, 403, 'You need to have admin rights on this directory')
         if path.isfile():
             try:
                 os.remove(path.absolute)
@@ -283,7 +303,7 @@ def removefile(self, dir, filename):
         elif path.isdir():
             if path.isempty():
                 try:
-                    dirs, files = path.listdir()
+                    dirs, files = path.listdir(hidden=True)
                     for f in files:
                         if f.ishidden():
                             os.remove(f.absolute)
@@ -300,7 +320,7 @@ def removefile(self, dir, filename):
         url = f'{conf.root_url}/download/{dir}'.strip('.')
         return url + '?' + qs
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def copyfile(self, dir, filename, newfilename):
         """
@@ -328,9 +348,21 @@ def copyfile(self, dir, filename, newfilename):
         url = f'{conf.root_url}/download/{dir}'.strip('.')
         return url + '?' + qs
 
+    @expose_for(Level.editor)
+    @web.method.post
+    def create_access_file(self, uri):
+        path = Path(uri)
+        rule = fa.AccessRule.find_rule(path)
+        owner = fa.get_owner(path)
+        if rule(users.current, owner)>=fa.Mode.admin:
+            rule.save(path)
+            raise goto((path / fa.filename))
+        else:
+            raise DownloadPageError(path, status=403, message='Only admins can create access files')
+
 
 
-    @expose_for(group.editor)
+    @expose_for(Level.editor)
     @web.method.post
     def write_to_file(self, path, text):
         path = Path(path)
@@ -351,7 +383,7 @@ def write_to_file(self, path, text):
     @expose_for()
     @web.method.post
     def action(self, path, actionid: int):
-        from ..auth import users, User
+        from ..auth import users, User, Level
         path = Path(path)
         action_id = web.conv(int, actionid)
         handler = self.filehandler[path]
@@ -360,8 +392,8 @@ def action(self, path, actionid: int):
         except IndexError:
             raise DownloadPageError('not enough actions available')
         if users.current.level < action.access_level:
-            required_group = User.groups[action.access_level]
-            raise DownloadPageError(path, 403,f'you need to be {required_group} for {action}')
+            required_group = Level(action.access_level)
+            raise DownloadPageError(path, 403,f'you need to be {required_group.name} for {action}')
         newpath = action(path)
         msg = {'msg': f'{action} on {path} successful'}
         return f'{newpath.href}?{urlencode(msg)}'
diff --git a/odmf/webpage/lib/render_tools.py b/odmf/webpage/lib/render_tools.py
index 6b6e98d9..9e0f9328 100644
--- a/odmf/webpage/lib/render_tools.py
+++ b/odmf/webpage/lib/render_tools.py
@@ -16,7 +16,7 @@ def markdown(s):
     return literal(__md(s))
 
 # The imports are needed implicitly during rendering
-from ..auth import users, is_member, has_level
+from ..auth import users, is_member, has_level, Level
 from datetime import datetime, timedelta
 
 
@@ -25,6 +25,8 @@ def prop(**kwargs):
         kw: (kw if value else None) for kw, value in kwargs.items()
     }
 
+def disabled(condition):
+    return prop(disabled=condition)
 
 def markoption(condition):
     return prop(selected=condition)
diff --git a/odmf/webpage/markdown.py b/odmf/webpage/markdown.py
index cbe40eed..be886dbf 100644
--- a/odmf/webpage/markdown.py
+++ b/odmf/webpage/markdown.py
@@ -109,6 +109,7 @@ def user2name(s):
         md.inlinePatterns.register(PatternLink(md, r'(file:)(\S+)', r'/download/\3', '\u25B8' + r'\3'), 'link files', 100)
         md.inlinePatterns.register(PatternLink(md, r'(#)([0-9]+)', r'/site/\3', '\u25B8' + r'\2\3'), 'link sites', 1000)
         md.inlinePatterns.register(PatternLink(md, r'(job:)([0-9]+)', r'/job/\3', '\u25B8' + r'\2\3'), 'link job', 100)
+        md.inlinePatterns.register(PatternLink(md, r'(project:)([0-9]+)', r'/project/\3', '\u25B8' + r'\2\3'), 'link project', 100)
         md.inlinePatterns.register(PatternLink(md, r'(dir:)(\S+)', r'/download/\3', '\u25B8' + r'\3'), 'link dir', 100)
         md.inlinePatterns.register(PatternLink(md, r'(user:)([a-zA-Z\.]+)', r'/user/\3', user2name), 'link user', 100)
         md.inlinePatterns.register(PatternLink(md, r'(photo:)([0-9]+)', r'/picture/?id=\3', '\u25B8' + r'\2\3'), 'link photo', 100)
diff --git a/odmf/webpage/static.py b/odmf/webpage/static.py
index 958bd8db..8129cf6b 100644
--- a/odmf/webpage/static.py
+++ b/odmf/webpage/static.py
@@ -6,10 +6,11 @@
 from cherrypy.lib.static import serve_file
 
 from . import lib as web
+from .auth import users
 from ..config import conf
 from pathlib import Path
 from markdown import markdown
-
+from .filemanager.file_auth import check_directory
 
 def filelist2html(files):
     text = '\n'.join(f'- [{f.name}]({f.name})' for f in files)
@@ -80,6 +81,8 @@ def index(self, path='.', _=None):
         Serves the static content from the relative path
         """
         p = self.get_path(path)
+        if not check_directory(p, users.current):
+            raise web.HTTPError(403, f'Forbidden access to resource {p} for {users.current.name}')
 
         if p.is_file():
             return serve_file(str(p), name=p.name)
diff --git a/tests/__init__.py b/tests/__init__.py
index f79aed6b..b1fa24b9 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -1,6 +1,6 @@
 import pytest
 
-@pytest.fixture(scope='class', autouse=True)
+@pytest.fixture(autouse=True)
 @pytest.mark.parametrize
 def conf(tmp_path_factory):
     """
diff --git a/tests/database_connection.py b/tests/database_connection.py
new file mode 100644
index 00000000..29957b1a
--- /dev/null
+++ b/tests/database_connection.py
@@ -0,0 +1,6 @@
+import psycopg2 as p2
+
+with p2.connect('postgresql://postgres:password@localhost:5432/postgres') as con:
+    with con.cursor() as cur:
+        cur.execute('SELECT datname FROM pg_database')
+        print('\n'.join(n for n, in cur))
diff --git a/tests/test_db/__init__.py b/tests/test_db/__init__.py
index 2a028b91..b3a64504 100644
--- a/tests/test_db/__init__.py
+++ b/tests/test_db/__init__.py
@@ -5,7 +5,7 @@
 from .. import conf
 
 
-@pytest.fixture(scope='class')
+@pytest.fixture()
 def db(conf):
     """
     Creates a database in memory with the schema from the ORM classes,
diff --git a/tests/test_db/test_dbdataset.py b/tests/test_db/test_dbdataset.py
index 5ee32d8d..4d5ae3b5 100644
--- a/tests/test_db/test_dbdataset.py
+++ b/tests/test_db/test_dbdataset.py
@@ -11,7 +11,7 @@
 
 
 
-@pytest.fixture(scope='class')
+@pytest.fixture()
 def db(conf):
     """
     Creates a database in memory with the schema from the ORM classes,
diff --git a/tests/test_db/test_dbobjects.py b/tests/test_db/test_dbobjects.py
index 4802be49..418ab7b7 100644
--- a/tests/test_db/test_dbobjects.py
+++ b/tests/test_db/test_dbobjects.py
@@ -1,14 +1,14 @@
 import datetime
 
 import pytest
-import sqlalchemy.orm
-from contextlib import contextmanager
 from PIL import Image
-import pathlib
-
+import random
+import string
 from . import temp_in_database, db, session, conf
 
 
+def randomstring(n):
+    return ''.join(random.sample(string.ascii_lowercase, n))
 
 @pytest.fixture()
 def site1_in_db(db, session):
@@ -143,9 +143,9 @@ def test_no_instrument(self, installation):
 def person(db, session):
     with temp_in_database(
         db.Person(
-            username='person_1', email='This is an email', firstname='first',
+            username=randomstring(10), email='This is an email', firstname='first',
             surname='last', telephone='this is a phone number', comment='this is a comment',
-            can_supervise= False, mobile='this is a mobile number', car_available=0
+            can_supervise= False, mobile='this is a mobile number', car_available=0, access_level=2
         ),
         session) as person:
         yield person
@@ -153,7 +153,6 @@ def person(db, session):
 class TestPerson:
     def test_person(self, person):
         assert person
-        assert person.username == 'person_1'
         assert isinstance(person.firstname, str)
         assert isinstance(person.surname, str)
         d = person.__jdict__()
@@ -241,9 +240,23 @@ def test_project(self, project):
     def test_project_load(self, project, session, db):
         project_1 = session.query(db.Project).get(1)
         assert project_1 == project
-        assert not project < project
-        assert str(project).startswith(" ")
-        assert repr(project).startswith("<Project")
+
+    def test_project_add_member(self, project, person):
+        project.add_member(person, 2)
+        members = list(project.members())
+        assert len(members) >= 1# , f'Added 1 one member to project, but project has {len(members)} member'
+        assert members[0][1] == 2# , f'Project member has unexpected access level of {members[0].access_level}!=1'
+
+        members2 = list(project.members(4)) # should contain the project owner
+        assert len(members2) == 1 , f'Added one member with al=2 to project, but project has {len(members2)} members above level 3'
+
+    def test_person_add_project(self, project, person):
+        person.add_project(project, 1)
+        projects = list(person.projects())
+        print(projects)
+        assert len(projects) >= 1 , f'Added 1 one member to project, but project has {len(projects)} member'
+        assert projects[0][1] == 1 , f'Project member has unexpected access level of {projects[0][1]}!=1'
+
 
 
 @pytest.fixture()
diff --git a/tests/webpage_integration/__init__.py b/tests/webpage_integration/__init__.py
index a1521d08..7a418753 100644
--- a/tests/webpage_integration/__init__.py
+++ b/tests/webpage_integration/__init__.py
@@ -13,7 +13,7 @@
 import cherrypy
 from ..webpage_unittest import root, db_session, conf
 
-@pytest.fixture(scope='class')
+@pytest.fixture()
 def webserver(root):
     cherrypy.tree.mount(root, conf.root_url)
     cherrypy.engine.start()
diff --git a/tests/webpage_unittest/__init__.py b/tests/webpage_unittest/__init__.py
index 09de7598..c105acda 100644
--- a/tests/webpage_unittest/__init__.py
+++ b/tests/webpage_unittest/__init__.py
@@ -4,7 +4,7 @@
 from .. import conf
 
 
-@pytest.fixture(scope='class')
+@pytest.fixture()
 def db(conf):
     """
     Creates a database in memory with the schema from the ORM classes,