diff -r d8c0784038f4 -r 0ff1de2aa55d hooks/security.py
--- a/hooks/security.py	Thu Jan 16 14:19:04 2014 +0100
+++ b/hooks/security.py	Tue Jan 14 11:14:41 2014 +0100
@@ -42,7 +42,7 @@
     for attr in editedattrs:
         if attr in dontcheck:
             continue
-        rdef = eschema.rdef(attr)
+        rdef = eschema.rdef(attr, takefirst=True)
         if rdef.final: # non final relation are checked by standard hooks
             perms = rdef.permissions.get(action)
             # comparison below works because the default update perm is: