Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/MenuItems/AdministratorMenuItem.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/MenuItems/AdministratorMenuItem.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/MenuItems/AdministratorMenuItem.cs	(revision 15658)
@@ -38,5 +38,6 @@
 
     public override void Execute() {
-      if (HiveRoles.CheckAdminUserPermissions()) {
+
+      if (HiveRoles.CheckAdminUserPermissions() || HiveAdminClient.Instance.CheckAccessToAdminAreaGranted()) {
         MainFormManager.MainForm.ShowContent(HiveAdminClient.Instance);
       } else if (!UserInformation.Instance.UserExists) {
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ProjectResourcesView.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ProjectResourcesView.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ProjectResourcesView.cs	(revision 15658)
@@ -44,6 +44,10 @@
     private readonly HashSet<Resource> inheritedResources = new HashSet<Resource>();
     private readonly HashSet<Resource> newInheritedResources = new HashSet<Resource>();
+
+    private readonly Dictionary<Guid, HashSet<Project>> projectAncestors = new Dictionary<Guid, HashSet<Project>>();
+    private readonly Dictionary<Guid, HashSet<Project>> projectDescendants = new Dictionary<Guid, HashSet<Project>>();
     private readonly Dictionary<Guid, HashSet<Resource>> resourceAncestors = new Dictionary<Guid, HashSet<Resource>>();
     private readonly Dictionary<Guid, HashSet<Resource>> resourceDescendants = new Dictionary<Guid, HashSet<Resource>>();
+
     //private readonly Color addedAssignmentColor = Color.FromArgb(255, 0, 174, 179); // #00aeb3
     private readonly Color addedAssignmentColor = Color.FromArgb(255, 87, 191, 193); // #57bfc1
@@ -75,4 +79,5 @@
         detailsViewHost.Content = null;
       } else {
+        UpdateProjectGenealogy();
         UpdateAssignedResources();
         UpdateResourceGenealogy();
@@ -91,4 +96,5 @@
 
     private void refreshButton_Click(object sender, EventArgs e) {
+      UpdateProjectGenealogy();
       UpdateAssignedResources();
       UpdateResourceGenealogy();
@@ -120,5 +126,11 @@
     private void treeView_BeforeCheck(object sender, TreeViewCancelEventArgs e) {
       var checkedResource = (Resource)e.Node.Tag;
-      if (newInheritedResources.Contains(checkedResource) || checkedResource.Id == Guid.Empty) e.Cancel = true;
+      if (newInheritedResources.Contains(checkedResource) || checkedResource.Id == Guid.Empty) {
+        e.Cancel = true;
+      } else if (!HiveRoles.CheckAdminUserPermissions()) {
+          if (!projectAncestors[Content.Id].Any()) {
+            e.Cancel = true;
+          }
+      }
     }
 
@@ -285,4 +297,11 @@
         if (newAssignedResources.Contains(newResource)) {
           newNode.Checked = true;
+          if(!HiveRoles.CheckAdminUserPermissions()) {
+            if(!projectAncestors[Content.Id].Any()) {
+              newNode.ForeColor = SystemColors.GrayText;
+              newNode.Text += " [immutable]";
+            }
+          }
+
         } else if (newInheritedResources.Contains(newResource)) {
           newNode.Checked = true;
@@ -331,18 +350,21 @@
       }
 
-      var ungroupedNode = new TreeNode(ungroupedGroupName) {
-        ForeColor = SystemColors.GrayText,
-        Tag = new SlaveGroup() {
-          Name = ungroupedGroupName,
-          Description = ungroupedGroupDescription
-        }
-      };
-
-      foreach (var slave in subResources.OfType<Slave>().OrderBy(x => x.Name)) {
-        var slaveNode = new TreeNode(slave.Name) { Tag = slave };
-        ungroupedNode.Nodes.Add(slaveNode);
-      }
-
-      treeView.Nodes.Add(ungroupedNode);
+      var ungroupedSlaves = subResources.OfType<Slave>().OrderBy(x => x.Name);
+      if(ungroupedSlaves.Any()) {
+        var ungroupedNode = new TreeNode(ungroupedGroupName) {
+          ForeColor = SystemColors.GrayText,
+          Tag = new SlaveGroup() {
+            Name = ungroupedGroupName,
+            Description = ungroupedGroupDescription
+          }
+        };
+
+        foreach (var slave in ungroupedSlaves) {
+          var slaveNode = new TreeNode(slave.Name) { Tag = slave };
+          ungroupedNode.Nodes.Add(slaveNode);
+        }
+        treeView.Nodes.Add(ungroupedNode);
+      }
+
       treeView.BeforeCheck += treeView_BeforeCheck;
       treeView.AfterCheck += treeView_AfterCheck;
@@ -352,4 +374,29 @@
     }
 
+    private void UpdateProjectGenealogy() {
+      projectAncestors.Clear();
+      projectDescendants.Clear();
+      var projects = HiveAdminClient.Instance.Projects;
+
+      foreach(var p in projects) {
+        projectAncestors.Add(p.Id, new HashSet<Project>());
+        projectDescendants.Add(p.Id, new HashSet<Project>());
+      }
+
+      foreach (var p in projects) {
+        var parentProjectId = p.ParentProjectId;
+        while (parentProjectId != null) {
+          var parent = projects.SingleOrDefault(x => x.Id == parentProjectId);
+          if (parent != null) {
+            projectAncestors[p.Id].Add(parent);
+            projectDescendants[parent.Id].Add(p);
+            parentProjectId = parent.ParentProjectId;
+          } else {
+            parentProjectId = null;
+          }
+        }
+      }
+    }
+
     #endregion
   }
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ProjectsView.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ProjectsView.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ProjectsView.cs	(revision 15658)
@@ -270,15 +270,15 @@
       //  selectedProject.PropertyChanged += ProjectViewContent_PropertyChanged;
 
-      if (IsAuthorized(selectedProject)) {
-        if (!tabControl.TabPages.Contains(permissionsTabPage))
-          tabControl.TabPages.Add(permissionsTabPage);
-        if (!tabControl.TabPages.Contains(resourcesTabPage))
-          tabControl.TabPages.Add(resourcesTabPage);
-      } else {
-        if (tabControl.TabPages.Contains(permissionsTabPage))
-          tabControl.TabPages.Remove(permissionsTabPage);
-        if (tabControl.TabPages.Contains(resourcesTabPage))
-          tabControl.TabPages.Remove(resourcesTabPage);
-      }
+      //if (IsAuthorized(selectedProject)) {
+      //  if (!tabControl.TabPages.Contains(permissionsTabPage))
+      //    tabControl.TabPages.Add(permissionsTabPage);
+      //  if (!tabControl.TabPages.Contains(resourcesTabPage))
+      //    tabControl.TabPages.Add(resourcesTabPage);
+      //} else {
+      //  if (tabControl.TabPages.Contains(permissionsTabPage))
+      //    tabControl.TabPages.Remove(permissionsTabPage);
+      //  if (tabControl.TabPages.Contains(resourcesTabPage))
+      //    tabControl.TabPages.Remove(resourcesTabPage);
+      //}
     }
 
@@ -416,7 +416,6 @@
 
     private bool IsAuthorized(Project project) {
-      return project != null
-          && UserInformation.Instance.UserExists
-          && (project.OwnerUserId == UserInformation.Instance.User.Id || HiveRoles.CheckAdminUserPermissions());
+      return project != null && UserInformation.Instance.UserExists;
+          //&& (project.OwnerUserId == UserInformation.Instance.User.Id || HiveRoles.CheckAdminUserPermissions());
     }
 
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ResourcesView.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ResourcesView.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.Administrator/3.3/Views/ResourcesView.cs	(revision 15658)
@@ -302,8 +302,11 @@
 
       var mainResources = new HashSet<Resource>(resources.OfType<SlaveGroup>().Where(x => x.ParentResourceId == null));
-      var subResources = new HashSet<Resource>(resources.Except(mainResources));
+      var parentedMainResources = new HashSet<Resource>(resources.OfType<SlaveGroup>()
+        .Where(x => x.ParentResourceId.HasValue && !resources.Select(y => y.Id).Contains(x.ParentResourceId.Value)));
+      mainResources.UnionWith(parentedMainResources);
+      var subResources = new HashSet<Resource>(resources.Except(mainResources).OrderByDescending(x => x.Name));
 
       var stack = new Stack<Resource>(mainResources.OrderByDescending(x => x.Name));
-      var top = stack.Peek();
+      Resource top = null;
 
       TreeNode currentNode = null;
@@ -311,4 +314,5 @@
 
       while(stack.Any()) {
+        if (top == null) top = stack.Peek();
         var newResource = stack.Pop();
         var newNode = new TreeNode(newResource.Name) { Tag = newResource };
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.JobManager/3.3/Views/HiveResourceSelector.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.JobManager/3.3/Views/HiveResourceSelector.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.JobManager/3.3/Views/HiveResourceSelector.cs	(revision 15658)
@@ -468,10 +468,10 @@
     private static IEnumerable<Resource> GetAssignedResourcesForProject(Guid projectId) {
       var assignedProjectResources = HiveServiceLocator.Instance.CallHiveService(s => s.GetAssignedResourcesForProject(projectId));
-      return HiveAdminClient.Instance.Resources.Where(x => assignedProjectResources.Select(y => y.ResourceId).Contains(x.Id));
+      return HiveClient.Instance.Resources.Where(x => assignedProjectResources.Select(y => y.ResourceId).Contains(x.Id));
     }
 
     private static IEnumerable<Resource> GetAssignedResourcesForJob(Guid jobId) {
       var assignedJobResources = HiveServiceLocator.Instance.CallHiveService(s => s.GetAssignedResourcesForJob(jobId));
-      return HiveAdminClient.Instance.Resources.Where(x => assignedJobResources.Select(y => y.ResourceId).Contains(x.Id));
+      return HiveClient.Instance.Resources.Where(x => assignedJobResources.Select(y => y.ResourceId).Contains(x.Id));
     }
 
@@ -581,5 +581,5 @@
       resourceAncestors.Clear();
       resourceDescendants.Clear();
-      var resources = HiveAdminClient.Instance.Resources;
+      var resources = HiveClient.Instance.Resources;
 
       foreach (var r in resources) {
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.JobManager/3.3/Views/HiveResourceSelectorDialog.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.JobManager/3.3/Views/HiveResourceSelectorDialog.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive.JobManager/3.3/Views/HiveResourceSelectorDialog.cs	(revision 15658)
@@ -80,12 +80,12 @@
     #region Overrides
     protected override void OnLoad(EventArgs e) {
-      HiveAdminClient.Instance.Refreshing += HiveAdminClient_Instance_Refreshing;
-      HiveAdminClient.Instance.Refreshed += HiveAdminClient_Instance_Refreshed;
+      HiveClient.Instance.Refreshing += HiveClient_Instance_Refreshing;
+      HiveClient.Instance.Refreshed += HiveClient_Instance_Refreshed;
       base.OnLoad(e);
     }
 
     protected override void OnClosing(CancelEventArgs e) {
-      HiveAdminClient.Instance.Refreshed -= HiveAdminClient_Instance_Refreshed;
-      HiveAdminClient.Instance.Refreshing -= HiveAdminClient_Instance_Refreshing;
+      HiveClient.Instance.Refreshed -= HiveClient_Instance_Refreshed;
+      HiveClient.Instance.Refreshing -= HiveClient_Instance_Refreshing;
       base.OnClosing(e);
     }
@@ -93,6 +93,6 @@
 
     #region Event Handlers
-    private void HiveAdminClient_Instance_Refreshing(object sender, EventArgs e) {
-      if (InvokeRequired) Invoke((Action<object, EventArgs>)HiveAdminClient_Instance_Refreshing, sender, e);
+    private void HiveClient_Instance_Refreshing(object sender, EventArgs e) {
+      if (InvokeRequired) Invoke((Action<object, EventArgs>)HiveClient_Instance_Refreshing, sender, e);
       else {
         var mainForm = MainFormManager.GetMainForm<MainForm.WindowsForms.MainForm>();
@@ -102,6 +102,6 @@
     }
 
-    private void HiveAdminClient_Instance_Refreshed(object sender, EventArgs e) {
-      if (InvokeRequired) Invoke((Action<object, EventArgs>)HiveAdminClient_Instance_Refreshed, sender, e);
+    private void HiveClient_Instance_Refreshed(object sender, EventArgs e) {
+      if (InvokeRequired) Invoke((Action<object, EventArgs>)HiveClient_Instance_Refreshed, sender, e);
       else {
         var mainForm = MainFormManager.GetMainForm<MainForm.WindowsForms.MainForm>();
@@ -129,5 +129,5 @@
 
       await SecurityExceptionUtil.TryAsyncAndReportSecurityExceptions(
-        action: () => UpdateProjects(),
+        action: () => UpdateInstance(),
         finallyCallback: () => updatingProjects = false);
     }
@@ -151,6 +151,10 @@
 
     #region Helpers
+    private void UpdateInstance() {
+      HiveClient.Instance.Refresh();
+    }
+
     private void UpdateProjects() {
-      HiveAdminClient.Instance.Refresh();
+      HiveClient.Instance.RefreshProjectsAndResources();
       hiveResourceSelector.JobId = jobId;
       hiveResourceSelector.ProjectId = projectId;
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/HiveAdminClient.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/HiveAdminClient.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/HiveAdminClient.cs	(revision 15658)
@@ -24,4 +24,5 @@
 using HeuristicLab.Common;
 using HeuristicLab.Core;
+using System.Collections.Generic;
 
 namespace HeuristicLab.Clients.Hive {
@@ -36,4 +37,5 @@
     }
 
+    #region Properties
     private IItemList<Resource> resources;
     public IItemList<Resource> Resources {
@@ -62,4 +64,6 @@
     }
 
+    #endregion
+
     #region Events
     public event EventHandler Refreshing;
@@ -86,6 +90,6 @@
 
         HiveServiceLocator.Instance.CallHiveService(service => {
-          service.GetSlaveGroups().ForEach(g => resources.Add(g));
-          service.GetSlaves().ForEach(s => resources.Add(s));
+          service.GetSlaveGroupsForAdministration().ForEach(g => resources.Add(g));
+          service.GetSlavesForAdministration().ForEach(s => resources.Add(s));
           service.GetProjectsForAdministration().ForEach(p => projects.Add(p));
         });
@@ -174,4 +178,18 @@
       }
     }
+
+    #region
+    public bool CheckAccessToAdminAreaGranted() {
+      if(projects != null) {
+        return projects.Count > 0;
+      } else {
+        bool accessGranted = false;
+        HiveServiceLocator.Instance.CallHiveService(s => {
+          accessGranted = s.CheckAccessToAdminAreaGranted();
+        });
+        return accessGranted;
+      }
+    }
+    #endregion
   }
 }
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/HiveClient.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/HiveClient.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/HiveClient.cs	(revision 15658)
@@ -57,4 +57,15 @@
     }
 
+    private IItemList<Project> projects;
+    public IItemList<Project> Projects {
+      get { return projects; }
+    }
+
+    private IItemList<Resource> resources;
+    public IItemList<Resource> Resources {
+      get { return resources; }
+    }
+
+
     private List<Plugin> onlinePlugins;
     public List<Plugin> OnlinePlugins {
@@ -93,16 +104,43 @@
 
       try {
+        projects = new ItemList<Project>();
+        resources = new ItemList<Resource>();
         jobs = new HiveItemCollection<RefreshableJob>();
-        var jobsLoaded = HiveServiceLocator.Instance.CallHiveService<IEnumerable<Job>>(s => s.GetJobs());
-
-        foreach (var j in jobsLoaded) {
-          jobs.Add(new RefreshableJob(j));
-        }
+
+        HiveServiceLocator.Instance.CallHiveService(service => {
+          service.GetProjects().ForEach(p => projects.Add(p));
+          service.GetSlaveGroups().ForEach(g => resources.Add(g));
+          service.GetSlaves().ForEach(s => resources.Add(s));
+          service.GetJobs().ForEach(p => jobs.Add(new RefreshableJob(p)));
+        });
       }
       catch {
         jobs = null;
+        projects = null;
+        resources = null;
         throw;
       }
       finally {
+        OnRefreshed();
+      }
+    }
+
+    public void RefreshProjectsAndResources() {
+      OnRefreshing();
+
+      try {
+        projects = new ItemList<Project>();
+        resources = new ItemList<Resource>();
+
+        HiveServiceLocator.Instance.CallHiveService(service => {
+          service.GetProjects().ForEach(p => projects.Add(p));
+          service.GetSlaveGroups().ForEach(g => resources.Add(g));
+          service.GetSlaves().ForEach(s => resources.Add(s));
+        });
+      } catch {
+        projects = null;
+        resources = null;
+        throw;
+      } finally {
         OnRefreshed();
       }
@@ -124,4 +162,5 @@
       }, null);
     }
+    
     #endregion
 
Index: /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/ServiceClients/HiveServiceClient.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/ServiceClients/HiveServiceClient.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Clients.Hive/3.3/ServiceClients/HiveServiceClient.cs	(revision 15658)
@@ -2492,4 +2492,10 @@
         System.Collections.Generic.List<HeuristicLab.Clients.Hive.SlaveGroup> GetSlaveGroups();
         
+        [System.ServiceModel.OperationContractAttribute(Action="http://tempuri.org/IHiveService/GetSlavesForAdministration", ReplyAction="http://tempuri.org/IHiveService/GetSlavesForAdministrationResponse")]
+        System.Collections.Generic.List<HeuristicLab.Clients.Hive.Slave> GetSlavesForAdministration();
+        
+        [System.ServiceModel.OperationContractAttribute(Action="http://tempuri.org/IHiveService/GetSlaveGroupsForAdministration", ReplyAction="http://tempuri.org/IHiveService/GetSlaveGroupsForAdministrationResponse")]
+        System.Collections.Generic.List<HeuristicLab.Clients.Hive.SlaveGroup> GetSlaveGroupsForAdministration();
+        
         [System.ServiceModel.OperationContractAttribute(Action="http://tempuri.org/IHiveService/UpdateSlave", ReplyAction="http://tempuri.org/IHiveService/UpdateSlaveResponse")]
         void UpdateSlave(HeuristicLab.Clients.Hive.Slave slave);
@@ -2539,4 +2545,7 @@
         [System.ServiceModel.OperationContractAttribute(Action="http://tempuri.org/IHiveService/GetUserGroupTree", ReplyAction="http://tempuri.org/IHiveService/GetUserGroupTreeResponse")]
         System.Collections.Generic.Dictionary<System.Guid, System.Collections.Generic.List<System.Guid>> GetUserGroupTree();
+        
+        [System.ServiceModel.OperationContractAttribute(Action="http://tempuri.org/IHiveService/CheckAccessToAdminAreaGranted", ReplyAction="http://tempuri.org/IHiveService/CheckAccessToAdminAreaGrantedResponse")]
+        bool CheckAccessToAdminAreaGranted();
         
         [System.ServiceModel.OperationContractAttribute(Action="http://tempuri.org/IHiveService/GetUserPriorities", ReplyAction="http://tempuri.org/IHiveService/GetUserPrioritiesResponse")]
@@ -2823,4 +2832,14 @@
         }
         
+        public System.Collections.Generic.List<HeuristicLab.Clients.Hive.Slave> GetSlavesForAdministration()
+        {
+            return base.Channel.GetSlavesForAdministration();
+        }
+        
+        public System.Collections.Generic.List<HeuristicLab.Clients.Hive.SlaveGroup> GetSlaveGroupsForAdministration()
+        {
+            return base.Channel.GetSlaveGroupsForAdministration();
+        }
+        
         public void UpdateSlave(HeuristicLab.Clients.Hive.Slave slave)
         {
@@ -2903,4 +2922,9 @@
         }
         
+        public bool CheckAccessToAdminAreaGranted()
+        {
+            return base.Channel.CheckAccessToAdminAreaGranted();
+        }
+        
         public System.Collections.Generic.List<HeuristicLab.Clients.Hive.UserPriority> GetUserPriorities()
         {
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/AssignedProjectResourceDao.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/AssignedProjectResourceDao.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/Daos/AssignedProjectResourceDao.cs	(revision 15658)
@@ -77,4 +77,13 @@
     public IEnumerable<Guid> GetAllGrantedResourceIdsByProjectId(Guid projectId) {
       return DataContext.ExecuteQuery<Guid>(GetAllGrantedResourceIdsByProjectIdQueryString, projectId);
+    }
+
+    public IEnumerable<Resource> GetAllGrantedResourcesByProjectIds(IEnumerable<Guid> projectIds) {
+      string paramProjectIds = string.Join(",", projectIds.ToList().Select(x => string.Format("'{0}'", x)));
+      if (!string.IsNullOrWhiteSpace(paramProjectIds)) {
+        string queryString = string.Format(GetAllGrantedResourcesByProjectIdsQueryString, paramProjectIds);
+        return DataContext.ExecuteQuery<Resource>(queryString);
+      }
+      return Enumerable.Empty<Resource>();
     }
 
@@ -173,4 +182,25 @@
     WHERE apr.ProjectId = '{0}'
     ";
+    private const string GetAllGrantedResourcesByProjectIdsQueryString = @"
+      WITH rtree AS
+      (
+	      SELECT ResourceId, ParentResourceId
+	      FROM [Resource]
+	      UNION ALL
+	      SELECT rt.ResourceId, r.ParentResourceId
+	      FROM [Resource] r
+	      JOIN rtree rt ON rt.ParentResourceId = r.ResourceId
+      )
+      SELECT res.*
+      FROM rtree, [AssignedProjectResource] apr, [Resource] res
+      WHERE rtree.ParentResourceId = apr.ResourceId
+      AND rtree.ResourceId = res.ResourceId
+      AND apr.ProjectId IN ({0})
+      UNION
+      SELECT res.*
+      FROM [AssignedProjectResource] apr, [Resource] res
+      WHERE apr.ResourceId = res.ResourceId
+      AND apr.ProjectId IN ({0})
+    ";
     private const string GetAllGrantedResourceIdsOfOwnedParentProjectsQueryString = @"
       WITH pbranch AS
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/HeuristicLab.Services.Hive.DataAccess-3.3.csproj
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/HeuristicLab.Services.Hive.DataAccess-3.3.csproj	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive.DataAccess/3.3/HeuristicLab.Services.Hive.DataAccess-3.3.csproj	(revision 15658)
@@ -110,7 +110,9 @@
     <Compile Include="Daos\HiveStatistics\DimClientDao.cs" />
     <Compile Include="Daos\HiveStatistics\DimJobDao.cs" />
+    <Compile Include="Daos\HiveStatistics\DimProjectDao.cs" />
     <Compile Include="Daos\HiveStatistics\DimTimeDao.cs" />
     <Compile Include="Daos\HiveStatistics\DimUserDao.cs" />
     <Compile Include="Daos\HiveStatistics\FactClientInfoDao.cs" />
+    <Compile Include="Daos\HiveStatistics\FactProjectInfoDao.cs" />
     <Compile Include="Daos\HiveStatistics\FactTaskDao.cs" />
     <Compile Include="Daos\JobDao.cs" />
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/HiveService.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/HiveService.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/HiveService.cs	(revision 15658)
@@ -1129,55 +1129,127 @@
     public IEnumerable<DT.Slave> GetSlaves() {
       RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
-      bool isAdministrator = RoleVerifier.IsInRole(HiveRoles.Administrator);
       var pm = PersistenceManager;
       using (new PerformanceLogger("GetSlaves")) {
         var slaveDao = pm.SlaveDao;
-        //var projectPermissionDao = pm.ProjectPermissionDao;
+        var projectDao = pm.ProjectDao;
+        var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
+
+        // collect user information
         var currentUserId = UserManager.CurrentUserId;
-        return pm.UseTransaction(() => {
-            return slaveDao.GetAll().ToList()
-              .Where( x => isAdministrator
-              || x.OwnerUserId == null 
-              || x.OwnerUserId == currentUserId)
+        var userAndGroupIds = new List<Guid> { currentUserId };
+        userAndGroupIds.AddRange(UserManager.GetUserGroupIdsOfUser(currentUserId));
+
+        return pm.UseTransaction(() => {
+          var slaves = slaveDao.GetAll()
+            .Select(x => x.ToDto())
+            .ToList();
+          var grantedProjectIds = projectDao.GetUsageGrantedProjectsForUser(userAndGroupIds)
+            .Select(x => x.ProjectId)
+            .ToList();
+          var grantedResourceIds = assignedProjectResourceDao.GetAllGrantedResourcesByProjectIds(grantedProjectIds)
+            .Select(x => x.ResourceId)
+            .ToList();
+
+          return slaves
+            .Where(x => grantedResourceIds.Contains(x.Id))
+            .ToList();
+        });
+      }
+    }
+
+    public IEnumerable<DT.SlaveGroup> GetSlaveGroups() {
+      RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      var pm = PersistenceManager;
+      using (new PerformanceLogger("GetSlaveGroups")) {
+        var slaveGroupDao = pm.SlaveGroupDao;
+        var projectDao = pm.ProjectDao;
+        var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
+
+        // collect user information
+        var currentUserId = UserManager.CurrentUserId;
+        var userAndGroupIds = new List<Guid> { currentUserId };
+        userAndGroupIds.AddRange(UserManager.GetUserGroupIdsOfUser(currentUserId));
+
+        return pm.UseTransaction(() => {
+          var slaveGroups = slaveGroupDao.GetAll()
+            .Select(x => x.ToDto())
+            .ToList();
+          var grantedProjectIds = projectDao.GetUsageGrantedProjectsForUser(userAndGroupIds)
+            .Select(x => x.ProjectId)
+            .ToList();
+          var grantedResourceIds = assignedProjectResourceDao.GetAllGrantedResourcesByProjectIds(grantedProjectIds)
+            .Select(x => x.ResourceId)
+            .ToList();
+
+          return slaveGroups
+            .Where(x => grantedResourceIds.Contains(x.Id))
+            .ToList();
+        });
+      }
+    }
+
+    public IEnumerable<DT.Slave> GetSlavesForAdministration() {
+      RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      bool isAdministrator = RoleVerifier.IsInRole(HiveRoles.Administrator);
+      var pm = PersistenceManager;
+      using (new PerformanceLogger("GetSlavesForAdministration")) {
+        var slaveDao = pm.SlaveDao;
+        var currentUserId = UserManager.CurrentUserId;
+
+        if (isAdministrator) {
+          return pm.UseTransaction(() => {
+            return slaveDao.GetAll()
               .Select(x => x.ToDto())
               .ToList();
-          //var projectPermissions = projectPermissionDao.GetAll();
-          //return slaveDao.GetAll().ToList()
-          //  .Where(x => isAdministrator
-          //    || x.OwnerUserId == null
-          //    || x.OwnerUserId == currentUserId
-          //    || UserManager.VerifyUser(currentUserId, projectPermissions
-          //        //.Where(y => y.ResourceId == x.ResourceId)
-          //        .Select(z => z.GrantedUserId)
-          //        .ToList())
-          //    )
-          //  .Select(x => x.ToDto())
-          //  .ToList();
-        });
-      }
-    }
-
-    public IEnumerable<DT.SlaveGroup> GetSlaveGroups() {
+          });
+        } else {
+          var slaves = slaveDao.GetAll()
+            .Select(x => x.ToDto())
+            .ToList();
+          var projectDao = pm.ProjectDao;
+          var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
+          var projects = projectDao.GetAdministrationGrantedProjectsForUser(currentUserId).ToList();
+          var resourceIds = assignedProjectResourceDao
+            .GetAllGrantedResourcesByProjectIds(projects.Select(x => x.ProjectId).ToList())
+            .Select(x => x.ResourceId)
+            .ToList();
+
+          return slaves
+            .Where(x => resourceIds.Contains(x.Id))
+            .ToList();
+        }
+      }
+    }
+
+    public IEnumerable<DT.SlaveGroup> GetSlaveGroupsForAdministration() {
       RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
       bool isAdministrator = RoleVerifier.IsInRole(HiveRoles.Administrator);
       var pm = PersistenceManager;
-      using (new PerformanceLogger("GetSlaveGroups")) {
+      using (new PerformanceLogger("GetSlaveGroupsForAdministration")) {
         var slaveGroupDao = pm.SlaveGroupDao;
-        var projectPermissionDao = pm.ProjectPermissionDao;
         var currentUserId = UserManager.CurrentUserId;
-        return pm.UseTransaction(() => {
-          //var projectPermissions = projectPermissionDao.GetAll();
-          return slaveGroupDao.GetAll().ToList()
-            .Where(x => isAdministrator
-              || x.OwnerUserId == null
-              || x.OwnerUserId == currentUserId
-              //|| UserManager.VerifyUser(currentUserId, projectPermissions
-              //    //.Where(y => y.ResourceId == x.ResourceId)
-              //    .Select(z => z.GrantedUserId)
-              //    .ToList())
-             )
+
+        if (isAdministrator) {
+          return pm.UseTransaction(() => {
+            return slaveGroupDao.GetAll()
+              .Select(x => x.ToDto())
+              .ToList();
+          });
+        } else {
+          var slaveGroups = slaveGroupDao.GetAll()
             .Select(x => x.ToDto())
             .ToList();
-        });
+          var projectDao = pm.ProjectDao;
+          var assignedProjectResourceDao = pm.AssignedProjectResourceDao;
+          var projects = projectDao.GetAdministrationGrantedProjectsForUser(currentUserId).ToList();
+          var resourceIds = assignedProjectResourceDao
+            .GetAllGrantedResourcesByProjectIds(projects.Select(x => x.ProjectId).ToList())
+            .Select(x => x.ResourceId)
+            .ToList();
+
+          return slaveGroups
+            .Where(x => resourceIds.Contains(x.Id))
+            .ToList();
+        }
       }
     }
@@ -1185,4 +1257,5 @@
     public void UpdateSlave(DT.Slave slaveDto) {
       RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      AuthorizationManager.AuthorizeForResourceAdministration(slaveDto.Id);
       var pm = PersistenceManager;
       using (new PerformanceLogger("UpdateSlave")) {
@@ -1202,4 +1275,5 @@
     public void UpdateSlaveGroup(DT.SlaveGroup slaveGroupDto) {
       RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      AuthorizationManager.AuthorizeForResourceAdministration(slaveGroupDto.Id);
       var pm = PersistenceManager;
       using (new PerformanceLogger("UpdateSlaveGroup")) {
@@ -1405,4 +1479,19 @@
 
       return userGroupTree;
+    }
+
+    public bool CheckAccessToAdminAreaGranted() {
+      RoleVerifier.AuthenticateForAnyRole(HiveRoles.Administrator, HiveRoles.Client);
+      bool isAdministrator = RoleVerifier.IsInRole(HiveRoles.Administrator);
+      var pm = PersistenceManager;
+      using(new PerformanceLogger("CheckAccessToAdminAreaGranted")) {
+        if (isAdministrator) {
+          return true;
+        } else {
+          var projectDao = pm.ProjectDao;
+          var currentUserId = UserManager.CurrentUserId;
+          return projectDao.GetAdministrationGrantedProjectsForUser(currentUserId).Any();
+        }
+      }
     }
     #endregion
Index: /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs
===================================================================
--- /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs	(revision 15657)
+++ /branches/HiveProjectManagement/HeuristicLab.Services.Hive/3.3/ServiceContracts/IHiveService.cs	(revision 15658)
@@ -210,4 +210,10 @@
 
     [OperationContract]
+    IEnumerable<Slave> GetSlavesForAdministration();
+
+    [OperationContract]
+    IEnumerable<SlaveGroup> GetSlaveGroupsForAdministration();
+
+    [OperationContract]
     void UpdateSlave(Slave slave);
 
@@ -260,4 +266,7 @@
     [OperationContract]
     Dictionary<Guid, HashSet<Guid>> GetUserGroupTree();
+
+    [OperationContract]
+    bool CheckAccessToAdminAreaGranted();
     #endregion
 
