Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/AssignedProjectResourceDao.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/AssignedProjectResourceDao.cs	(revision 15539)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/AssignedProjectResourceDao.cs	(revision 15540)
@@ -61,4 +61,9 @@
       return DataContext.ExecuteQuery<Guid>(GetAllGrantedResourceIdsByProjectIdQueryString, projectId);
     }
+
+    public IEnumerable<Guid> GetAllGrantedResourceIdsOfOwnedParentProjects(Guid projectId, Guid userId) {
+      return DataContext.ExecuteQuery<Guid>(GetAllGrantedResourceIdsOfOwnedParentProjectsQueryString, projectId, userId);
+    }
+
 
     #region Compiled queries
@@ -140,4 +145,31 @@
     WHERE apr.ProjectId = {0}
     ";
+    private const string GetAllGrantedResourceIdsOfOwnedParentProjectsQueryString = @"
+      WITH pbranch AS
+      (
+	      SELECT ProjectId, ParentProjectId
+	      FROM [Project]
+	      UNION ALL
+	      SELECT pb.ProjectId, p.ParentProjectId
+	      FROM [Project] p
+	      JOIN pbranch pb ON pb.ParentProjectId = p.ProjectId AND p.ParentProjectId <> p.ProjectId AND pb.ParentProjectId <> pb.ProjectId
+      ),
+      rtree AS
+      (
+	      SELECT ResourceId, ParentResourceId
+	      FROM [Resource]
+	      UNION ALL
+	      SELECT rt.ResourceId, r.ParentResourceId
+	      FROM [Resource] r
+	      JOIN rtree rt ON rt.ParentResourceId = r.ResourceId AND r.ParentResourceId <> r.ResourceId AND rt.ParentResourceId <> rt.ResourceId
+      )
+      SELECT DISTINCT rtree.ResourceId
+      FROM pbranch, rtree, [Project] pro, [AssignedProjectResource] apr
+      WHERE pbranch.ProjectId = {0}
+      AND pbranch.ParentProjectId = pro.ProjectId
+      AND pro.OwnerUserId = {1}
+      AND pbranch.ParentProjectId = apr.ProjectId
+      AND apr.ResourceId = rtree.ParentResourceId
+    ";
     #endregion
   }
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/ProjectDao.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/ProjectDao.cs	(revision 15539)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/ProjectDao.cs	(revision 15540)
@@ -153,4 +153,38 @@
       FROM pbranch
     ";
+    private const string GetNearestOwnedParentProjectByIdQuery = @"
+      WITH pbranch AS
+      (
+	      SELECT ProjectId, ParentProjectId, CAST(ProjectId AS NVARCHAR(MAX)) Path, 1 Distance
+	      FROM [Project]
+	      WHERE ProjectId = {0}
+	      UNION ALL
+	      SELECT pb.ProjectId, p.ParentProjectId, pb.Path + N', ' + CAST(pb.ProjectId AS NVARCHAR(MAX)), pb.Distance + 1
+	      FROM [Project] p
+	      JOIN pbranch pb ON pb.ParentProjectId = p.ProjectId AND p.ParentProjectId <> p.ProjectId AND pb.ParentProjectId <> pb.ProjectId
+      )
+      SELECT TOP(1) pro.*
+      FROM pbranch, [Project] pro
+      WHERE pbranch.ParentProjectId = pro.ProjectId
+      AND pro.OwnerUserId = {1}
+      ORDER BY pbranch.Distance
+    ";
+    private const string GetFarestOwnedParentProjectIdByIdQuery = @"
+      WITH pbranch AS
+      (
+	      SELECT ProjectId, ParentProjectId, CAST(ProjectId AS NVARCHAR(MAX)) Path, 1 Distance
+	      FROM [Project]
+	      WHERE ProjectId = {0}
+	      UNION ALL
+	      SELECT pb.ProjectId, p.ParentProjectId, pb.Path + N', ' + CAST(pb.ProjectId AS NVARCHAR(MAX)), pb.Distance + 1
+	      FROM [Project] p
+	      JOIN pbranch pb ON pb.ParentProjectId = p.ProjectId AND p.ParentProjectId <> p.ProjectId AND pb.ParentProjectId <> pb.ProjectId
+      )
+      SELECT TOP(1) pro.*
+      FROM pbranch, [Project] pro
+      WHERE pbranch.ParentProjectId = pro.ProjectId
+      AND pro.OwnerUserId = {1}
+      ORDER BY pbranch.Distance DESC
+    ";
     #endregion
   }
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/ResourceDao.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/ResourceDao.cs	(revision 15539)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/ResourceDao.cs	(revision 15540)
@@ -35,4 +35,13 @@
     public Resource GetByName(string name) {
       return GetByNameQuery(DataContext, name);
+    }
+
+    public bool CheckExistence(IEnumerable<Guid> ids) {
+      string paramResourceIds = string.Join(",", ids.Select(x => string.Format("'{0}'", x)));
+      if (!string.IsNullOrWhiteSpace(paramResourceIds)) {
+        string queryString = string.Format(CountExistenceQuery, paramResourceIds);
+        return DataContext.ExecuteQuery<int>(queryString).Count() == ids.Count();
+      }
+      return false;
     }
 
@@ -80,4 +89,9 @@
 
     #region String queries
+    private const string CountExistenceQuery = @"
+      SELECT COUNT(DISTINCT r.ResourceId)
+      FROM [Resource] r
+      WHERE r.ResourceId IN ({0})
+    ";
     private const string GetChildResourcesByIdQuery = @"
     	WITH rtree AS
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/HeuristicLab.Services.Hive.DataAccess-3.3.csproj
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/HeuristicLab.Services.Hive.DataAccess-3.3.csproj	(revision 15539)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/HeuristicLab.Services.Hive.DataAccess-3.3.csproj	(revision 15540)
@@ -104,4 +104,5 @@
   <ItemGroup>
     <None Include="Plugin.cs.frame" />
+    <Compile Include="Daos\AssignedJobResourceDao.cs" />
     <Compile Include="Daos\AssignedProjectResourceDao.cs" />
     <Compile Include="Daos\AssignedTaskResourceDao.cs" />
@@ -123,5 +124,4 @@
     <Compile Include="Daos\RequiredPluginDao.cs" />
     <Compile Include="Daos\ResourceDao.cs" />
-    <Compile Include="Daos\ResourcePermissionDao.cs" />
     <Compile Include="Daos\SlaveDao.cs" />
     <Compile Include="Daos\SlaveGroupDao.cs" />
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs	(revision 15539)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Interfaces/IAuthorizationManager.cs	(revision 15540)
@@ -39,4 +39,6 @@
     void AuthorizeForProjectAdministration(Guid projectId);
 
+    void AuthorizeForProjectResourceAdministration(Guid projectId, IEnumerable<Guid> resourceIds);
+
     void AuthorizeProjectForResourcesUse(Guid projectId, IEnumerable<Guid> resourceIds);
 
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs	(revision 15539)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/Manager/AuthorizationManager.cs	(revision 15540)
@@ -72,4 +72,5 @@
     }
 
+    // authorize if user is admin or resource owner
     public void AuthorizeForResourceAdministration(Guid resourceId) {
       var pm = PersistenceManager;
@@ -78,4 +79,5 @@
         var resource = resourceDao.GetById(resourceId);
         if (resource == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
+
         if (resource.OwnerUserId != UserManager.CurrentUserId
             && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
@@ -85,15 +87,44 @@
     }
 
+    // authorize if user is admin, project owner or owner of a parent project
     public void AuthorizeForProjectAdministration(Guid projectId) {
       var pm = PersistenceManager;
       var projectDao = pm.ProjectDao;
       pm.UseTransaction(() => {
+        // check if project exists (not necessary)
         var project = projectDao.GetById(projectId);
         if (project == null) throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
 
-        var projectTree = projectDao.GetCurrentAndParentProjectsById(projectId);
-        if(!projectTree.Select(x => x.OwnerUserId).Contains(UserManager.CurrentUserId)
+        var projectBranch = projectDao.GetCurrentAndParentProjectsById(projectId);
+        if(!projectBranch.Select(x => x.OwnerUserId).Contains(UserManager.CurrentUserId)
             && !RoleVerifier.IsInRole(HiveRoles.Administrator)) {
           throw new SecurityException(NOT_AUTHORIZED_USERPROJECT);
+        }
+      });
+    }
+
+    // authorize if user is admin, or owner of a parent project, for which the resources are assigned to
+    public void AuthorizeForProjectResourceAdministration(Guid projectId, IEnumerable<Guid> resourceIds) {
+      var pm = PersistenceManager;
+      var projectDao = pm.ProjectDao;
+      var resourceDao = pm.ResourceDao;
+      var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
+      pm.UseTransaction(() => {
+        // check if project exists (not necessary)
+        var project = projectDao.GetById(projectId);
+        if (project == null) throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
+
+        // check if resourceIds exist
+        if (!resourceDao.CheckExistence(resourceIds))
+          throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
+
+        // check if user is admin
+        if (RoleVerifier.IsInRole(HiveRoles.Administrator)) return;
+
+        // check if user is owner of a parent project and...
+        // check if the all argument resourceIds are among the assigned resources of the owned projects
+        var grantedResourceIds = assignedProjectResourceDao.GetAllGrantedResourceIdsOfOwnedParentProjects(projectId, UserManager.CurrentUserId);
+        if(resourceIds.Except(grantedResourceIds).Any()) {
+          throw new SecurityException(NOT_AUTHORIZED_USERRESOURCE);
         }
       });
