--- a/schemas/base.py	Wed Mar 03 17:39:22 2010 +0100
+++ b/schemas/base.py	Wed Mar 03 17:42:19 2010 +0100
@@ -212,6 +212,8 @@
 
     Also, checkout the AppObject.get_cache() method.
     """
+    # XXX only handle by hooks, shouldn't be readable/editable at all through
+    # the ui and so no permissions should be granted, no?
     __permissions__ = {
         'read':   ('managers', 'users', 'guests'),
         'add':    ('managers',),