diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToExperimentTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToExperimentTest.java
index d75a72934b93585c1bff8c533ee19a5bbe2bddb2..5d89216f947d403287392b2071e1d1e5eebbaa74 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToExperimentTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToExperimentTest.java
@@ -33,26 +33,27 @@ import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ExternalData;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
  */
 public class AssignDataSetToExperimentTest extends BaseTest
 {
-    private Experiment sourceExperiment;
+    Experiment sourceExperiment;
 
-    private Experiment destinationExperiment;
+    Experiment destinationExperiment;
 
-    private Space sourceSpace;
+    Space sourceSpace;
 
-    private Space destinationSpace;
+    Space destinationSpace;
 
     @Test
     public void dataSetWithoutSampleCanBeUpdatedToAnotherExperiment() throws Exception
@@ -76,7 +77,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void sampleAssignmentOfDataSetIsRemovedWhenDataSetIsAssignedToNewExperiment()
+    public void sampleAssignmentOfDataSetIsRemovedWhenDataSetIsAssignedToAnotherExperiment()
             throws Exception
     {
         Sample sample = create(aSample().inExperiment(sourceExperiment));
@@ -88,7 +89,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void childDataSetCanBeAssignedToNewExperiment() throws Exception
+    public void childDataSetCanBeAssignedToAnotherExperiment() throws Exception
     {
         ExternalData parent = create(aDataSet().inExperiment(sourceExperiment));
         ExternalData child = create(aDataSet().inExperiment(sourceExperiment).withParent(parent));
@@ -99,7 +100,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfParentDataSetIsNotChangedWhenChildDataSetIsAssignedToNewExperiment()
+    public void experimentAssignmentOfParentDataSetIsNotChangedWhenChildDataSetIsAssignedToAnotherExperiment()
             throws Exception
     {
         ExternalData parent = create(aDataSet().inExperiment(sourceExperiment));
@@ -111,7 +112,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void parentDataSetCanBeAssignedToNewExperiment() throws Exception
+    public void parentDataSetCanBeAssignedToAnotherExperiment() throws Exception
     {
         ExternalData parent = create(aDataSet().inExperiment(sourceExperiment));
         create(aDataSet().inExperiment(sourceExperiment).withParent(parent));
@@ -122,7 +123,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfChildDataSetIsNotChangedWhenParentDatasetIsAssignedToNewExperiment()
+    public void experimentAssignmentOfChildDataSetIsNotChangedWhenParentDatasetIsAssignedToAnotherExperiment()
             throws Exception
     {
         ExternalData parent = create(aDataSet().inExperiment(sourceExperiment));
@@ -134,7 +135,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void componentDataSetCanBeAssignedToNewSample() throws Exception
+    public void componentDataSetCanBeAssignedToAnotherExperiment() throws Exception
     {
         ExternalData component = create(aDataSet().inExperiment(sourceExperiment));
         create(aDataSet().inExperiment(sourceExperiment).withComponent(component));
@@ -145,7 +146,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfContainerDataSetIsNotChangedWhenComponentDataSetIsAssignedToNewExperiment()
+    public void experimentAssignmentOfContainerDataSetIsNotChangedWhenComponentDataSetIsAssignedToAnotherExperiment()
             throws Exception
     {
         ExternalData component = create(aDataSet().inExperiment(sourceExperiment));
@@ -158,7 +159,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void containerDataSetCanBeAssignedToNewSample() throws Exception
+    public void containerDataSetCanBeAssignedToAnotherExperiment() throws Exception
     {
         ExternalData component = create(aDataSet().inExperiment(sourceExperiment));
         ExternalData container =
@@ -170,7 +171,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfComponentDataSetIsNotChangedWhenContainerDataSetIsAssignedToNewExperiment()
+    public void experimentAssignmentOfComponentDataSetIsNotChangedWhenContainerDataSetIsAssignedToAnotherExperiment()
             throws Exception
     {
         ExternalData component = create(aDataSet().inExperiment(sourceExperiment));
@@ -183,7 +184,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @Test(dataProvider = "rolesAllowedToAssignDataSetToExperiment", groups = "authorization")
-    public void assigningDataSetToExperimentIsAllowedFor(
+    public void assigningDataSetToAnotherExperimentIsAllowedFor(
             RoleWithHierarchy sourceSpaceRole,
             RoleWithHierarchy destinationSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
@@ -198,7 +199,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
 
     @Test(dataProvider = "rolesNotAllowedToAssignDataSetToExperiment", expectedExceptions =
         { AuthorizationFailureException.class }, groups = "authorization")
-    public void assigningDataSetToExperimentIsNotAllowedFor(
+    public void assigningDataSetToAnotherExperimentIsNotAllowedFor(
             RoleWithHierarchy sourceSpaceRole,
             RoleWithHierarchy destinationSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
@@ -212,7 +213,7 @@ public class AssignDataSetToExperimentTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         sourceSpace = create(aSpace());
         Project sourceProject = create(aProject().inSpace(sourceSpace));
@@ -223,47 +224,42 @@ public class AssignDataSetToExperimentTest extends BaseTest
         destinationExperiment = create(anExperiment().inProject(destinationProject));
     }
 
+    GuardedDomain source;
+
+    GuardedDomain destination;
+
+    GuardedDomain instance;
+
+    AuthorizationRule assignDataSetToExperimentRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        source = new SpaceDomain("space1", instance);
+        destination = new SpaceDomain("space2", instance);
 
         assignDataSetToExperimentRule =
-                or(
-                        and(
-                                rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                or(
-                                        rule(space2, RoleWithHierarchy.SPACE_POWER_USER),
-                                        rule(space2, RoleWithHierarchy.SPACE_ETL_SERVER),
-                                        rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
-                                )
-                        ),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                and(
+                        rule(source, RoleWithHierarchy.SPACE_POWER_USER),
+                        or(
+                                rule(destination, RoleWithHierarchy.SPACE_POWER_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_ETL_SERVER)
+                        )
                 );
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule assignDataSetToExperimentRule;
-
     @DataProvider
     Object[][] rolesAllowedToAssignDataSetToExperiment()
     {
-        return RolePermutator.getAcceptedPermutations(assignDataSetToExperimentRule, space1,
-                space2,
-                instance);
+        return RolePermutator.getAcceptedPermutations(assignDataSetToExperimentRule, source,
+                destination, instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignDataSetToExperiment()
     {
-        return RolePermutator.getAcceptedPermutations(not(assignDataSetToExperimentRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(assignDataSetToExperimentRule), source,
+                destination, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToSampleTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToSampleTest.java
index cce25181a04a64ecfbdfd467efd8aec985625ee8..45fbc384c3752b9a6c66a7c46944b4cd74088aed 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToSampleTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignDataSetToSampleTest.java
@@ -18,7 +18,6 @@ package ch.systemsx.cisd.openbis.systemtest;
 
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.and;
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.not;
-import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.or;
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.rule;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -33,13 +32,14 @@ import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ExternalData;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -47,20 +47,20 @@ import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
 public class AssignDataSetToSampleTest extends BaseTest
 {
 
-    private Sample sourceSample;
+    Sample sourceSample;
 
-    private Sample destinationSample;
+    Sample destinationSample;
 
-    private Experiment sourceExperiment;
+    Experiment sourceExperiment;
 
-    private Experiment destinationExperiment;
+    Experiment destinationExperiment;
 
-    private Space sourceSpace;
+    Space sourceSpace;
 
-    private Space destinationSpace;
+    Space destinationSpace;
 
     @Test
-    public void dataSetWithSampleCanBeAssignedToNewSample() throws Exception
+    public void dataSetWithSampleCanBeAssignedToAnotherSample() throws Exception
     {
         ExternalData dataset = create(aDataSet().inSample(sourceSample));
 
@@ -80,7 +80,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void dataSetWithoutSampleCanBeAssignedToNewSample() throws Exception
+    public void dataSetWithoutSampleCanBeAssignedToSample() throws Exception
     {
         ExternalData dataset = create(aDataSet().inExperiment(sourceExperiment));
 
@@ -110,7 +110,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void childDataSetCanBeAssignedToNewSample() throws Exception
+    public void childDataSetCanBeAssignedToAnotherSample() throws Exception
     {
         ExternalData parent = create(aDataSet().inSample(sourceSample));
         ExternalData child = create(aDataSet().inSample(sourceSample).withParent(parent));
@@ -121,7 +121,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void sampleAssignmentOfParentDataSetIsNotChangedWhenChildDataSetIsAssignedToNewSample()
+    public void sampleAssignmentOfParentDataSetIsNotChangedWhenChildDataSetIsAssignedToAnotherSample()
             throws Exception
     {
         ExternalData parent = create(aDataSet().inSample(sourceSample));
@@ -133,7 +133,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void parentDataSetCanBeAssignedToNewSample() throws Exception
+    public void parentDataSetCanBeAssignedToAnotherSample() throws Exception
     {
         ExternalData parent = create(aDataSet().inSample(sourceSample));
         create(aDataSet().inSample(sourceSample).withParent(parent));
@@ -144,7 +144,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void sampleAssignmentOfChildDataSetIsNotChangedWhenParentDatasetIsAssignedToNewSample()
+    public void sampleAssignmentOfChildDataSetIsNotChangedWhenParentDatasetIsAssignedToAnotherSample()
             throws Exception
     {
         ExternalData parent = create(aDataSet().inSample(sourceSample));
@@ -156,7 +156,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void componentDataSetCanBeAssignedToNewSample() throws Exception
+    public void componentDataSetCanBeAssignedToAnotherSample() throws Exception
     {
         ExternalData component = create(aDataSet().inSample(sourceSample));
         create(aDataSet().inSample(sourceSample).withComponent(component));
@@ -167,7 +167,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void sampleAssignmentOfContainerDataSetIsNotChangedWhenComponentDataSetIsAssignedToNewSample()
+    public void sampleAssignmentOfContainerDataSetIsNotChangedWhenComponentDataSetIsAssignedToAnotherSample()
             throws Exception
     {
         ExternalData component = create(aDataSet().inSample(sourceSample));
@@ -179,7 +179,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void containerDataSetCanBeAssignedToNewSample() throws Exception
+    public void containerDataSetCanBeAssignedToAnotherSample() throws Exception
     {
         ExternalData component = create(aDataSet().inSample(sourceSample));
         ExternalData container = create(aDataSet().inSample(sourceSample).withComponent(component));
@@ -190,7 +190,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @Test
-    public void sampleAssignmentOfComponentDataSetIsNotChangedWhenContainerDataSetIsAssignedToNewSample()
+    public void sampleAssignmentOfComponentDataSetIsNotChangedWhenContainerDataSetIsAssignedToAnotherSample()
             throws Exception
     {
         ExternalData component = create(aDataSet().inSample(sourceSample));
@@ -231,7 +231,7 @@ public class AssignDataSetToSampleTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         sourceSpace = create(aSpace());
         Project sourceProject = create(aProject().inSpace(sourceSpace));
@@ -244,41 +244,40 @@ public class AssignDataSetToSampleTest extends BaseTest
         destinationSample = create(aSample().inExperiment(destinationExperiment));
     }
 
+    GuardedDomain source;
+
+    GuardedDomain destination;
+
+    GuardedDomain instance;
+
+    AuthorizationRule assignDataSetToSampleRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        source = new SpaceDomain("space1", instance);
+        destination = new SpaceDomain("space2", instance);
 
         assignDataSetToSampleRule =
-                or(
-                        and(
-                                rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_POWER_USER)),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                and(
+                        rule(source, RoleWithHierarchy.SPACE_POWER_USER),
+                        rule(destination, RoleWithHierarchy.SPACE_POWER_USER)
                 );
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule assignDataSetToSampleRule;
-
     @DataProvider
     Object[][] rolesAllowedToAssignDataSetToSample()
     {
-        return RolePermutator.getAcceptedPermutations(assignDataSetToSampleRule, space1, space2,
+        return RolePermutator.getAcceptedPermutations(assignDataSetToSampleRule, source,
+                destination,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignDataSetToSample()
     {
-        return RolePermutator.getAcceptedPermutations(not(assignDataSetToSampleRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(assignDataSetToSampleRule), source,
+                destination, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignExperimentToProjectTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignExperimentToProjectTest.java
index f4a36e4bea611602ed64d84436e7dc4746c42dea..2915d98fb3e4446c35797e2c944bdf51b46d764a 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignExperimentToProjectTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignExperimentToProjectTest.java
@@ -31,13 +31,14 @@ import ch.systemsx.cisd.common.exceptions.AuthorizationFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -45,13 +46,13 @@ import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
 public class AssignExperimentToProjectTest extends BaseTest
 {
 
-    private Space sourceSpace;
+    Space sourceSpace;
 
-    private Space destinationSpace;
+    Space destinationSpace;
 
-    private Project sourceProject;
+    Project sourceProject;
 
-    private Project destinationProject;
+    Project destinationProject;
 
     @Test
     public void experimentCanBeUpdatedToAnotherProject() throws Exception
@@ -105,7 +106,7 @@ public class AssignExperimentToProjectTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         sourceSpace = create(aSpace());
         destinationSpace = create(aSpace());
@@ -113,49 +114,49 @@ public class AssignExperimentToProjectTest extends BaseTest
         destinationProject = create(aProject().inSpace(destinationSpace));
     }
 
+    GuardedDomain source;
+
+    GuardedDomain destination;
+
+    GuardedDomain instance;
+
+    AuthorizationRule assignExperimentToProjectRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        source = new SpaceDomain("space1", instance);
+        destination = new SpaceDomain("space2", instance);
 
         assignExperimentToProjectRule =
                 or(
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_POWER_USER)),
+                                rule(source, RoleWithHierarchy.SPACE_POWER_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_POWER_USER)
+                        ),
 
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                                rule(source, RoleWithHierarchy.SPACE_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_USER),
+                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
+                        )
                 );
 
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule assignExperimentToProjectRule;
-
     @DataProvider
     Object[][] rolesAllowedToAssignExperimentToProject()
     {
-        return RolePermutator.getAcceptedPermutations(assignExperimentToProjectRule, space1,
-                space2,
+        return RolePermutator.getAcceptedPermutations(assignExperimentToProjectRule, source,
+                destination,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignExperimentToProject()
     {
-        return RolePermutator.getAcceptedPermutations(not(assignExperimentToProjectRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(assignExperimentToProjectRule), source,
+                destination, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignProjectToSpaceTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignProjectToSpaceTest.java
index 56cfbfe220b610351767e1ce4ce0e686599bd5b6..97814cc5c9389d4dba4118578ac4df33295f59e8 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignProjectToSpaceTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignProjectToSpaceTest.java
@@ -18,7 +18,6 @@ package ch.systemsx.cisd.openbis.systemtest;
 
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.and;
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.not;
-import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.or;
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.rule;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -31,13 +30,14 @@ import ch.systemsx.cisd.common.exceptions.AuthorizationFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -49,7 +49,7 @@ public class AssignProjectToSpaceTest extends BaseTest
     Space destinationSpace;
 
     @Test
-    public void projectCanBeAssignedToNewSpace() throws Exception
+    public void projectCanBeAssignedToAnotherSpace() throws Exception
     {
         Project project = create(aProject().inSpace(sourceSpace));
 
@@ -59,7 +59,7 @@ public class AssignProjectToSpaceTest extends BaseTest
     }
 
     @Test
-    public void assigningProjectToNewSpaceChangesSpaceAssignmentOfSamplesInExperimentsInThatProject()
+    public void assigningProjectToAnotherSpaceChangesSpaceAssignmentOfSamplesInExperimentsInThatProject()
             throws Exception
     {
         Project project = create(aProject().inSpace(sourceSpace));
@@ -101,51 +101,47 @@ public class AssignProjectToSpaceTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         sourceSpace = create(aSpace());
         destinationSpace = create(aSpace());
     }
 
+    GuardedDomain source;
+
+    GuardedDomain destination;
+
+    GuardedDomain instance;
+
+    AuthorizationRule assignProjectToSpaceRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        source = new SpaceDomain("space1", instance);
+        destination = new SpaceDomain("space2", instance);
 
         assignProjectToSpaceRule =
-                or(
-                        and(
-                                rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_POWER_USER)),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                and(
+                        rule(source, RoleWithHierarchy.SPACE_POWER_USER),
+                        rule(destination, RoleWithHierarchy.SPACE_POWER_USER)
                 );
-
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule assignProjectToSpaceRule;
-
     @DataProvider
     Object[][] rolesAllowedToAssignProjectToSpace()
     {
-        return RolePermutator.getAcceptedPermutations(assignProjectToSpaceRule, space1,
-                space2,
+        return RolePermutator.getAcceptedPermutations(assignProjectToSpaceRule, source,
+                destination,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignProjectToSpace()
     {
-        return RolePermutator.getAcceptedPermutations(not(assignProjectToSpaceRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(assignProjectToSpaceRule), source,
+                destination, instance);
     }
 
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToExperimentTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToExperimentTest.java
index 7a9c5db51d079e269ed42077a9b664b0aa688586..a1612b4f1539a4802d18ce20a9d3329050e3e68c 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToExperimentTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToExperimentTest.java
@@ -33,13 +33,14 @@ import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.ExternalData;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -59,7 +60,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     Space destinationSpace;
 
     @Test
-    public void sampleWithExperimentCanBeAssignedToNewExperiment() throws Exception
+    public void sampleWithExperimentCanBeAssignedToAnotherExperiment() throws Exception
     {
         Sample sample = create(aSample().inExperiment(sourceExperiment));
 
@@ -113,7 +114,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void childSampleCanBeAssignedToNewExperiment() throws Exception
+    public void childSampleCanBeAssignedToAnotherExperiment() throws Exception
     {
         Sample parent = create(aSample().inExperiment(sourceExperiment));
         Sample child = create(aSample().withParent(parent).inExperiment(sourceExperiment));
@@ -125,7 +126,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfParentSampleIsNotChangedWhenChildSampleIsAssignedToNewExperiment()
+    public void experimentAssignmentOfParentSampleIsNotChangedWhenChildSampleIsAssignedToAnotherExperiment()
             throws Exception
     {
         Sample parent = create(aSample().inExperiment(sourceExperiment));
@@ -138,7 +139,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void parentSampleCanBeAssignedToNewExperiment() throws Exception
+    public void parentSampleCanBeAssignedToAnotherExperiment() throws Exception
     {
         Sample parent = create(aSample().inExperiment(sourceExperiment));
         create(aSample().withParent(parent).inExperiment(sourceExperiment));
@@ -150,7 +151,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfChildSampleIsNotChangedWhenParentSampleIsAssignmedToNewExperiment()
+    public void experimentAssignmentOfChildSampleIsNotChangedWhenParentSampleIsAssignmedToAnotherExperiment()
             throws Exception
     {
         Sample parent = create(aSample().inExperiment(sourceExperiment));
@@ -163,7 +164,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void componentSampleCanBeAssignedToNewExperiment() throws Exception
+    public void componentSampleCanBeAssignedToAnotherExperiment() throws Exception
     {
         Sample container = create(aSample().inExperiment(sourceExperiment));
         Sample component = create(aSample().inContainer(container).inExperiment(sourceExperiment));
@@ -175,7 +176,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfContainerSampleIsNotChangedWhenComponentSampleIsAssignedToNewExperiment()
+    public void experimentAssignmentOfContainerSampleIsNotChangedWhenComponentSampleIsAssignedToAnotherExperiment()
             throws Exception
     {
         Sample container = create(aSample().inExperiment(sourceExperiment));
@@ -188,7 +189,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void containerSampleCanBeAssignedToNewExperiment() throws Exception
+    public void containerSampleCanBeAssignedToAnotherExperiment() throws Exception
     {
         Sample container = create(aSample().inExperiment(sourceExperiment));
         create(aSample().inContainer(container).inExperiment(sourceExperiment));
@@ -200,7 +201,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfComponentSampleIsNotChangedWhenContainerSampleIsAssignedToNewExperiment()
+    public void experimentAssignmentOfComponentSampleIsNotChangedWhenContainerSampleIsAssignedToAnotherExperiment()
             throws Exception
     {
         Sample container = create(aSample().inExperiment(sourceExperiment));
@@ -225,7 +226,7 @@ public class AssignSampleToExperimentTest extends BaseTest
 
     @Test(expectedExceptions =
         { UserFailureException.class })
-    public void sampleWithoutExperimentCanNotBeAssignedToNewExperimentInAnotherSpaceThroughExperimentUpdate()
+    public void sampleWithoutExperimentCanNotBeAssignedToExperimentInAnotherSpaceThroughExperimentUpdate()
             throws Exception
     {
         Sample sample = create(aSample().inSpace(sourceSpace));
@@ -237,18 +238,19 @@ public class AssignSampleToExperimentTest extends BaseTest
 
     @Test(expectedExceptions =
         { UserFailureException.class })
-    public void sampleWithExperimentCanNotBeAssignedToExperimentThroughExperimentUpdate()
+    public void sampleWithExperimentCanNotBeAssignedToAnotherExperimentThroughExperimentUpdate()
             throws Exception
     {
-        Experiment destination = create(anExperiment().inProject(sourceProject));
+        Experiment destinationExperimentInSameSpace =
+                create(anExperiment().inProject(sourceProject));
         Sample sample = create(aSample().inExperiment(sourceExperiment));
 
-        perform(anUpdateOf(destination).withSamples(sample));
+        perform(anUpdateOf(destinationExperimentInSameSpace).withSamples(sample));
     }
 
     @Test(expectedExceptions =
         { UserFailureException.class })
-    public void sharedSampleCanNotBeAssignedToNewExperimentThroughExperimentUpdate()
+    public void sharedSampleCanNotBeAssignedToExperimentThroughExperimentUpdate()
             throws Exception
     {
         Sample sample = create(aSample());
@@ -259,7 +261,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     }
 
     @Test
-    public void registeringExperimentWithSampleInSameSpaceThatIsNotAssignedToExperimentAssignsTheSampleToTheNewExperiment()
+    public void registeringExperimentWithSampleInSameSpaceThatIsNotAssignedToAnyExperimentAssignsTheSampleToTheExperiment()
             throws Exception
     {
         Sample sample = create(aSample().inSpace(sourceSpace));
@@ -368,79 +370,75 @@ public class AssignSampleToExperimentTest extends BaseTest
                         .withCode("destinationExperiment"));
     }
 
+    GuardedDomain source;
+
+    GuardedDomain destination;
+
+    GuardedDomain instance;
+
+    AuthorizationRule assignSampleToExperimentRule;
+
+    AuthorizationRule assignSampleToExperimentThroughExperimentUpdateRule;
+
+    AuthorizationRule assignSharedSampleToExperimentRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        source = new SpaceDomain("space1", instance);
+        destination = new SpaceDomain("space2", instance);
 
         assignSampleToExperimentRule =
                 or(
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_POWER_USER)),
+                                rule(source, RoleWithHierarchy.SPACE_POWER_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_POWER_USER)),
 
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                                rule(source, RoleWithHierarchy.SPACE_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_USER),
+                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
+                        )
                 );
 
         assignSampleToExperimentThroughExperimentUpdateRule =
                 or(
-                        rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
+                        rule(source, RoleWithHierarchy.SPACE_POWER_USER),
 
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_USER),
+                                rule(source, RoleWithHierarchy.SPACE_USER),
                                 rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
-                        ),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                        )
                 );
 
         assignSharedSampleToExperimentRule =
-                or(
-                        and(
-                                rule(space1, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                and(
+                        rule(destination, RoleWithHierarchy.SPACE_USER),
+                        rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
                 );
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule assignSampleToExperimentRule;
-
-    public AuthorizationRule assignSampleToExperimentThroughExperimentUpdateRule;
-
-    public AuthorizationRule assignSharedSampleToExperimentRule;
-
     @DataProvider
     Object[][] rolesAllowedToAssignSampleToExperiment()
     {
-        return RolePermutator.getAcceptedPermutations(assignSampleToExperimentRule, space1, space2,
+        return RolePermutator.getAcceptedPermutations(assignSampleToExperimentRule, source,
+                destination,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignSampleToExperiment()
     {
-        return RolePermutator.getAcceptedPermutations(not(assignSampleToExperimentRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(assignSampleToExperimentRule), source,
+                destination, instance);
     }
 
     @DataProvider
     Object[][] rolesAllowedToAssignSampleToExperimentThroughExperimentUpdate()
     {
         return RolePermutator.getAcceptedPermutations(
-                assignSampleToExperimentThroughExperimentUpdateRule, space1,
+                assignSampleToExperimentThroughExperimentUpdateRule, source,
                 instance);
     }
 
@@ -448,7 +446,7 @@ public class AssignSampleToExperimentTest extends BaseTest
     Object[][] rolesNotAllowedToAssignSampleToExperimentThroughExperimentUpdate()
     {
         return RolePermutator.getAcceptedPermutations(
-                not(assignSampleToExperimentThroughExperimentUpdateRule), space1,
+                not(assignSampleToExperimentThroughExperimentUpdateRule), source,
                 instance);
     }
 
@@ -456,13 +454,13 @@ public class AssignSampleToExperimentTest extends BaseTest
     Object[][] rolesAllowedToAssignSharedSampleToExperiment()
     {
         return RolePermutator.getAcceptedPermutations(assignSharedSampleToExperimentRule,
-                space1, instance);
+                destination, instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignSharedSampleToExperiment()
     {
         return RolePermutator.getAcceptedPermutations(not(assignSharedSampleToExperimentRule),
-                space1, instance);
+                destination, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToSpaceTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToSpaceTest.java
index 923bd247116f50537bc21b567e0175ff256c6664..f4afa30eaa3c9e1e8dd63ed0549c2ac7c55b04fd 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToSpaceTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/AssignSampleToSpaceTest.java
@@ -32,13 +32,14 @@ import ch.systemsx.cisd.common.exceptions.AuthorizationFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -46,14 +47,14 @@ import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
 public class AssignSampleToSpaceTest extends BaseTest
 {
 
-    public Experiment experiment;
+    Experiment experiment;
 
-    public Space sourceSpace;
+    Space sourceSpace;
 
-    public Space destinationSpace;
+    Space destinationSpace;
 
     @Test
-    public void sampleWithExperimentCanBeAssignedToNewSpace() throws Exception
+    public void sampleWithExperimentCanBeAssignedToAnotherSpace() throws Exception
     {
         Sample sample = create(aSample().inExperiment(experiment));
 
@@ -63,7 +64,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void experimentAssignmentOfSampleIsRemovedWhenSampleIsAssignedToNewSpace()
+    public void experimentAssignmentOfSampleIsRemovedWhenSampleIsAssignedToAnotherSpace()
             throws Exception
     {
         Sample sample = create(aSample().inExperiment(experiment));
@@ -74,7 +75,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void spaceSampleCanBeAssignedToNewSpace() throws Exception
+    public void spaceSampleCanBeAssignedToAnotherSpace() throws Exception
     {
         Sample sample = create(aSample().inSpace(sourceSpace));
 
@@ -94,7 +95,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void childSampleCanBeAssignedToNewSpace()
+    public void childSampleCanBeAssignedToAnotherSpace()
             throws Exception
     {
         Sample parent = create(aSample().inExperiment(experiment));
@@ -106,7 +107,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void spaceAssignmentOfParentSampleIsNotChangedWhenChildSampleIsAssignedToNewSpace()
+    public void spaceAssignmentOfParentSampleIsNotChangedWhenChildSampleIsAssignedToAnotherSpace()
             throws Exception
     {
         Sample parent = create(aSample().inExperiment(experiment));
@@ -118,7 +119,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void parentSampleCanBeAssignedToNewSpace() throws Exception
+    public void parentSampleCanBeAssignedToAnotherSpace() throws Exception
     {
         Sample parent = create(aSample().inExperiment(experiment));
         create(aSample().inExperiment(experiment).withParent(parent));
@@ -129,7 +130,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void spaceAssignmentOfChildSampleIsNotChangedWhenParentSampleIsAssignedToNewSpace()
+    public void spaceAssignmentOfChildSampleIsNotChangedWhenParentSampleIsAssignedToAnotherSpace()
             throws Exception
     {
         Sample parent = create(aSample().inExperiment(experiment));
@@ -141,7 +142,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void componentSampleCanBeAssignedToNewSpace() throws Exception
+    public void componentSampleCanBeAssignedToAnotherSpace() throws Exception
     {
         Sample container = create(aSample().inExperiment(experiment));
         Sample component = create(aSample().inExperiment(experiment).inContainer(container));
@@ -152,7 +153,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void spaceAssignmentOfContainerSampleIsNotChangedWhenComponentSampleIsAssignedToNewSpace()
+    public void spaceAssignmentOfContainerSampleIsNotChangedWhenComponentSampleIsAssignedToAnotherSpace()
             throws Exception
     {
         Sample container = create(aSample().inExperiment(experiment));
@@ -164,7 +165,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void containerSampleCanBeAssignedToNewSpace() throws Exception
+    public void containerSampleCanBeAssignedToAnotherSpace() throws Exception
     {
         Sample container = create(aSample().inExperiment(experiment));
         create(aSample().inExperiment(experiment).inContainer(container));
@@ -175,7 +176,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void spaceAssignmentOfComponentSampleIsNotChangedWhenContainerSampleIsAssingnedToNewSpace()
+    public void spaceAssignmentOfComponentSampleIsNotChangedWhenContainerSampleIsAssingnedToAnotherSpace()
             throws Exception
     {
         Sample container = create(aSample().inExperiment(experiment));
@@ -187,7 +188,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test(dataProvider = "rolesAllowedToAssignSampleToSpace", groups = "authorization")
-    public void assigningSampleToSpaceIsAllowedFor(
+    public void assigningSampleToAnotherSpaceIsAllowedFor(
             RoleWithHierarchy sourceSpaceRole,
             RoleWithHierarchy destinationSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
@@ -202,7 +203,7 @@ public class AssignSampleToSpaceTest extends BaseTest
 
     @Test(dataProvider = "rolesNotAllowedToAssignSampleToSpace", expectedExceptions =
         { AuthorizationFailureException.class }, groups = "authorization")
-    public void assigningSampleToSpaceIsNotAllowedFor(
+    public void assigningSampleToAnotherSpaceIsNotAllowedFor(
             RoleWithHierarchy sourceSpaceRole,
             RoleWithHierarchy destinationSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
@@ -243,7 +244,7 @@ public class AssignSampleToSpaceTest extends BaseTest
     }
 
     @Test
-    public void assigningSampleToSameSpaceIsAllowedToAllSpaceUsersAsNoRealChangeIsMade()
+    public void assigningSampleToSameSpaceIsAllowedToAllSpaceUsers()
             throws Exception
     {
         Sample sample = create(aSample().inSpace(sourceSpace));
@@ -264,71 +265,67 @@ public class AssignSampleToSpaceTest extends BaseTest
                 create(anExperiment().inProject(project));
     }
 
+    GuardedDomain source;
+
+    GuardedDomain destination;
+
+    GuardedDomain instance;
+
+    AuthorizationRule assignSampleToSpaceRule;
+
+    AuthorizationRule assignSharedSampleToSpaceRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        source = new SpaceDomain("space1", instance);
+        destination = new SpaceDomain("space2", instance);
 
         assignSampleToSpaceRule =
                 or(
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_POWER_USER)),
+                                rule(source, RoleWithHierarchy.SPACE_POWER_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_POWER_USER)),
 
                         and(
-                                rule(space1, RoleWithHierarchy.SPACE_USER),
-                                rule(space2, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                                rule(source, RoleWithHierarchy.SPACE_USER),
+                                rule(destination, RoleWithHierarchy.SPACE_USER),
+                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER))
                 );
 
         assignSharedSampleToSpaceRule =
-                or(
-                        and(
-                                rule(space1, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                and(
+                        rule(destination, RoleWithHierarchy.SPACE_USER),
+                        rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
                 );
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule assignSampleToSpaceRule;
-
-    public AuthorizationRule assignSharedSampleToSpaceRule;
-
     @DataProvider
     Object[][] rolesAllowedToAssignSampleToSpace()
     {
-        return RolePermutator.getAcceptedPermutations(assignSampleToSpaceRule, space1, space2,
+        return RolePermutator.getAcceptedPermutations(assignSampleToSpaceRule, source, destination,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignSampleToSpace()
     {
-        return RolePermutator.getAcceptedPermutations(not(assignSampleToSpaceRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(assignSampleToSpaceRule), source,
+                destination, instance);
     }
 
     @DataProvider
     Object[][] rolesAllowedToAssignSharedSampleToSpace()
     {
         return RolePermutator.getAcceptedPermutations(assignSharedSampleToSpaceRule,
-                space1, instance);
+                destination, instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToAssignSharedSampleToSpace()
     {
         return RolePermutator.getAcceptedPermutations(not(assignSharedSampleToSpaceRule),
-                space1, instance);
+                destination, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromExperimentTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromExperimentTest.java
index b3c4e90acef22f054ca486ca40fd72562d035ce6..55d56dc1a17044f7be3e7d0c9e03900c267c10a3 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromExperimentTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromExperimentTest.java
@@ -33,25 +33,26 @@ import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
  */
 public class UnassignSampleFromExperimentTest extends BaseTest
 {
-    private Experiment experiment;
+    Experiment experiment;
 
-    private Space space;
+    Space space;
 
     @Test
-    public void experimentAssignmentOfTheSampleIsRemoved()
+    public void experimentAssignmentOfSampleIsRemoved()
             throws Exception
     {
         Sample sample = create(aSample().inExperiment(experiment));
@@ -62,7 +63,7 @@ public class UnassignSampleFromExperimentTest extends BaseTest
     }
 
     @Test
-    public void spaceAssociationOfTheSampleIsLeftIntact() throws Exception
+    public void spaceAssociationOfSampleIsLeftIntact() throws Exception
     {
         Sample sample = create(aSample().inExperiment(experiment));
 
@@ -218,11 +219,17 @@ public class UnassignSampleFromExperimentTest extends BaseTest
         experiment = create(anExperiment().inProject(project));
     }
 
+    GuardedDomain spaceDomain;
+
+    GuardedDomain instance;
+
+    AuthorizationRule unassignSampleFromExperimentRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        spaceDomain = new GuardedDomain("space", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        spaceDomain = new SpaceDomain("space", instance);
 
         unassignSampleFromExperimentRule =
                 or(
@@ -230,31 +237,22 @@ public class UnassignSampleFromExperimentTest extends BaseTest
 
                         and(
                                 rule(spaceDomain, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
+                        )
                 );
     }
 
-    public GuardedDomain spaceDomain;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule unassignSampleFromExperimentRule;
-
     @DataProvider
     Object[][] rolesAllowedToUnassignSampleFromExperiment()
     {
         return RolePermutator.getAcceptedPermutations(unassignSampleFromExperimentRule,
-                spaceDomain,
-                instance);
+                spaceDomain, instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToUnassignSampleFromExperiment()
     {
         return RolePermutator.getAcceptedPermutations(not(unassignSampleFromExperimentRule),
-                spaceDomain,
-                instance);
+                spaceDomain, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromSpaceTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromSpaceTest.java
index 7df6143d8c62fb34d2bb5579301946a002f32cda..79b4a95c43ba4145e033352e152e7cfd2d12ef6e 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromSpaceTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UnassignSampleFromSpaceTest.java
@@ -18,7 +18,6 @@ package ch.systemsx.cisd.openbis.systemtest;
 
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.and;
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.not;
-import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.or;
 import static ch.systemsx.cisd.openbis.systemtest.base.auth.RuleBuilder.rule;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.nullValue;
@@ -33,22 +32,23 @@ import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Experiment;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Project;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
  */
 public class UnassignSampleFromSpaceTest extends BaseTest
 {
-    public Space space;
+    Space space;
 
-    public Experiment experiment;
+    Experiment experiment;
 
     @Test
     public void spaceLevelSampleCanBeUnassignedFromSpace() throws Exception
@@ -138,7 +138,7 @@ public class UnassignSampleFromSpaceTest extends BaseTest
     }
 
     @Test
-    public void componentOfSpaceLevelSampleCanBeShared() throws Exception
+    public void componentOfSpaceLevelSampleCanBeUnassignedFromSpace() throws Exception
     {
         Sample container = create(aSample().inExperiment(experiment));
         Sample component = create(aSample().inExperiment(experiment).inContainer(container));
@@ -161,7 +161,7 @@ public class UnassignSampleFromSpaceTest extends BaseTest
     }
 
     @Test
-    public void containerOfSpaceLevelSampleCanBeShared() throws Exception
+    public void containerOfSpaceLevelSampleCanBeUnassignedFromSpace() throws Exception
     {
         Sample container = create(aSample().inExperiment(experiment));
         create(aSample().inExperiment(experiment).inContainer(container));
@@ -216,34 +216,29 @@ public class UnassignSampleFromSpaceTest extends BaseTest
         experiment = create(anExperiment().inProject(project));
     }
 
+    GuardedDomain spaceDomain;
+
+    GuardedDomain instance;
+
+    AuthorizationRule unassignSampleFromSpaceRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-
-        spaceDomain = new GuardedDomain("space", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        spaceDomain = new SpaceDomain("space", instance);
 
         unassignSampleFromSpaceRule =
-                or(
-                        and(
-                                rule(spaceDomain, RoleWithHierarchy.SPACE_USER),
-                                rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
-                        ),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                and(
+                        rule(spaceDomain, RoleWithHierarchy.SPACE_USER),
+                        rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
                 );
     }
 
-    public GuardedDomain spaceDomain;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule unassignSampleFromSpaceRule;
-
     @DataProvider
     Object[][] rolesAllowedToUnassignSampleFromSpace()
     {
-        return RolePermutator.getAcceptedPermutations(unassignSampleFromSpaceRule,
-                spaceDomain,
+        return RolePermutator.getAcceptedPermutations(unassignSampleFromSpaceRule, spaceDomain,
                 instance);
     }
 
@@ -251,7 +246,6 @@ public class UnassignSampleFromSpaceTest extends BaseTest
     Object[][] rolesNotAllowedToUnassignSampleFromSpace()
     {
         return RolePermutator.getAcceptedPermutations(not(unassignSampleFromSpaceRule),
-                spaceDomain,
-                instance);
+                spaceDomain, instance);
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetContainmentTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetContainmentTest.java
index f876c7b08d4b8384aa64d055b6af3f343d1178d6..2466c171dec56e1c109b12ace8a164255cab1bc1 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetContainmentTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetContainmentTest.java
@@ -129,7 +129,7 @@ public class UpdateDataSetContainmentTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         Space space = create(aSpace());
         Project project = create(aProject().inSpace(space));
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetParentsTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetParentsTest.java
index ff891ef69b59c029dba4d3aa8e1b5b519b2882a3..8bab6547df57099101e2d4b5f337598ddb0e4de1 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetParentsTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateDataSetParentsTest.java
@@ -139,7 +139,7 @@ public class UpdateDataSetParentsTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         Space space = create(aSpace());
         Project project = create(aProject().inSpace(space));
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleContainmentTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleContainmentTest.java
index cc65d475b0c66cc1276632ee957a9d52a6de38f7..a69c137d5fffdf2c50eba094627422f007eb2d9d 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleContainmentTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleContainmentTest.java
@@ -31,13 +31,14 @@ import org.testng.annotations.Test;
 import ch.systemsx.cisd.common.exceptions.AuthorizationFailureException;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -61,8 +62,8 @@ public class UpdateSampleContainmentTest extends BaseTest
     @Test
     public void containerCanBeInAnotherSpace() throws Exception
     {
-        Space containerSpace = create(aSpace());
-        Sample container = create(aSample().inSpace(containerSpace));
+        Space spaceOfContainer = create(aSpace());
+        Sample container = create(aSample().inSpace(spaceOfContainer));
         Sample componentCandidate = create(aSample().inSpace(space));
 
         perform(anUpdateOf(componentCandidate).toHaveContainer(container));
@@ -136,22 +137,22 @@ public class UpdateSampleContainmentTest extends BaseTest
         assertThat(serverSays(sample).getContainer(), is(serverSays(sample)));
     }
 
-    Space sourceSpace;
+    Space containerSpace;
 
-    Space destinationSpace;
+    Space componentSpace;
 
     @Test(dataProvider = "rolesAllowedToSetContainerToSample", groups = "authorization")
     public void settingContainerToSampleIsAllowedFor(
-            RoleWithHierarchy sourceSpaceRole,
-            RoleWithHierarchy destinationSpaceRole,
+            RoleWithHierarchy containerSpaceRole,
+            RoleWithHierarchy componentSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
     {
-        Sample container = create(aSample().inSpace(sourceSpace));
-        Sample componentCandidate = create(aSample().inSpace(destinationSpace));
+        Sample container = create(aSample().inSpace(containerSpace));
+        Sample componentCandidate = create(aSample().inSpace(componentSpace));
 
         String user =
-                create(aSession().withSpaceRole(sourceSpaceRole, sourceSpace).withSpaceRole(
-                        destinationSpaceRole, destinationSpace).withInstanceRole(instanceRole));
+                create(aSession().withSpaceRole(containerSpaceRole, containerSpace).withSpaceRole(
+                        componentSpaceRole, componentSpace).withInstanceRole(instanceRole));
 
         perform(anUpdateOf(componentCandidate).toHaveContainer(container).as(user));
     }
@@ -159,32 +160,32 @@ public class UpdateSampleContainmentTest extends BaseTest
     @Test(dataProvider = "rolesNotAllowedToSetContainerToSample", expectedExceptions =
         { AuthorizationFailureException.class }, groups = "authorization")
     public void settingContainerToSampleIsNotAllowedFor(
-            RoleWithHierarchy sourceSpaceRole,
-            RoleWithHierarchy destinationSpaceRole,
+            RoleWithHierarchy containerSpaceRole,
+            RoleWithHierarchy componentSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
     {
-        Sample container = create(aSample().inSpace(sourceSpace));
-        Sample componentCandidate = create(aSample().inSpace(destinationSpace));
+        Sample container = create(aSample().inSpace(containerSpace));
+        Sample componentCandidate = create(aSample().inSpace(componentSpace));
 
         String user =
-                create(aSession().withSpaceRole(sourceSpaceRole, sourceSpace).withSpaceRole(
-                        destinationSpaceRole, destinationSpace).withInstanceRole(instanceRole));
+                create(aSession().withSpaceRole(containerSpaceRole, containerSpace).withSpaceRole(
+                        componentSpaceRole, componentSpace).withInstanceRole(instanceRole));
 
         perform(anUpdateOf(componentCandidate).toHaveContainer(container).as(user));
     }
 
     @Test(dataProvider = "rolesAllowedToRemoveContainerFromSample", groups = "authorization")
     public void removingContainerFromSampleIsAllowedFor(
-            RoleWithHierarchy sourceSpaceRole,
-            RoleWithHierarchy destinationSpaceRole,
+            RoleWithHierarchy containerSpaceRole,
+            RoleWithHierarchy componentSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
     {
-        Sample container = create(aSample().inSpace(sourceSpace));
-        Sample component = create(aSample().inSpace(destinationSpace).inContainer(container));
+        Sample container = create(aSample().inSpace(containerSpace));
+        Sample component = create(aSample().inSpace(componentSpace).inContainer(container));
 
         String user =
-                create(aSession().withSpaceRole(sourceSpaceRole, sourceSpace).withSpaceRole(
-                        destinationSpaceRole, destinationSpace).withInstanceRole(instanceRole));
+                create(aSession().withSpaceRole(containerSpaceRole, containerSpace).withSpaceRole(
+                        componentSpaceRole, componentSpace).withInstanceRole(instanceRole));
 
         perform(anUpdateOf(component).removingContainer().as(user));
     }
@@ -192,101 +193,102 @@ public class UpdateSampleContainmentTest extends BaseTest
     @Test(dataProvider = "rolesNotAllowedToRemoveContainerFromSample", expectedExceptions =
         { AuthorizationFailureException.class }, groups = "authorization")
     public void removingContainerFromSampleIsNotAllowedFor(
-            RoleWithHierarchy sourceSpaceRole,
-            RoleWithHierarchy destinationSpaceRole,
+            RoleWithHierarchy containerSpaceRole,
+            RoleWithHierarchy componentSpaceRole,
             RoleWithHierarchy instanceRole) throws Exception
     {
-        Sample container = create(aSample().inSpace(sourceSpace));
-        Sample component = create(aSample().inSpace(destinationSpace).inContainer(container));
+        Sample container = create(aSample().inSpace(containerSpace));
+        Sample component = create(aSample().inSpace(componentSpace).inContainer(container));
 
         String user =
-                create(aSession().withSpaceRole(sourceSpaceRole, sourceSpace).withSpaceRole(
-                        destinationSpaceRole, destinationSpace).withInstanceRole(instanceRole));
+                create(aSession().withSpaceRole(containerSpaceRole, containerSpace).withSpaceRole(
+                        componentSpaceRole, componentSpace).withInstanceRole(instanceRole));
 
         perform(anUpdateOf(component).removingContainer().as(user));
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         space = create(aSpace());
-        sourceSpace = create(aSpace());
-        destinationSpace = create(aSpace());
+        containerSpace = create(aSpace());
+        componentSpace = create(aSpace());
     }
 
+    GuardedDomain containerDomain;
+
+    GuardedDomain componentDomain;
+
+    GuardedDomain instance;
+
+    AuthorizationRule setContainerToSampleRule;
+
+    AuthorizationRule removeContainerFromSampleRule;
+
     @BeforeClass
-    protected void createAuthorizationRules()
+    void createAuthorizationRules()
     {
-        space1 = new GuardedDomain("space1", RoleLevel.SPACE);
-        space2 = new GuardedDomain("space2", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        containerDomain = new SpaceDomain("container", instance);
+        componentDomain = new SpaceDomain("component", instance);
 
         setContainerToSampleRule =
                 or(
                         and(
                                 or(
-                                        rule(space1, RoleWithHierarchy.SPACE_POWER_USER),
-                                        rule(space1, RoleWithHierarchy.SPACE_ETL_SERVER)
+                                        rule(containerDomain, RoleWithHierarchy.SPACE_POWER_USER),
+                                        rule(containerDomain, RoleWithHierarchy.SPACE_ETL_SERVER)
                                 ),
-                                rule(space2, RoleWithHierarchy.SPACE_POWER_USER)
+                                rule(componentDomain, RoleWithHierarchy.SPACE_POWER_USER)
 
                         ),
                         and(
-                                rule(space2, RoleWithHierarchy.SPACE_USER),
+                                rule(componentDomain, RoleWithHierarchy.SPACE_USER),
                                 rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
-                        ),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                        )
                 );
 
         removeContainerFromSampleRule =
                 or(
-                        rule(space2, RoleWithHierarchy.SPACE_POWER_USER),
+                        rule(componentDomain, RoleWithHierarchy.SPACE_POWER_USER),
 
                         and(
-                                rule(space2, RoleWithHierarchy.SPACE_USER),
+                                rule(componentDomain, RoleWithHierarchy.SPACE_USER),
                                 rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
-                        ),
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                        )
                 );
     }
 
-    public GuardedDomain space1;
-
-    public GuardedDomain space2;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule setContainerToSampleRule;
-
-    public AuthorizationRule removeContainerFromSampleRule;
-
     @DataProvider
     Object[][] rolesAllowedToSetContainerToSample()
     {
-        return RolePermutator.getAcceptedPermutations(setContainerToSampleRule, space1, space2,
+        return RolePermutator.getAcceptedPermutations(setContainerToSampleRule, containerDomain,
+                componentDomain,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToSetContainerToSample()
     {
-        return RolePermutator.getAcceptedPermutations(not(setContainerToSampleRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(setContainerToSampleRule),
+                containerDomain,
+                componentDomain, instance);
     }
 
     @DataProvider
     Object[][] rolesAllowedToRemoveContainerFromSample()
     {
-        return RolePermutator.getAcceptedPermutations(removeContainerFromSampleRule, space1,
-                space2,
+        return RolePermutator.getAcceptedPermutations(removeContainerFromSampleRule,
+                containerDomain,
+                componentDomain,
                 instance);
     }
 
     @DataProvider
     Object[][] rolesNotAllowedToRemoveContainerFromSample()
     {
-        return RolePermutator.getAcceptedPermutations(not(removeContainerFromSampleRule), space1,
-                space2, instance);
+        return RolePermutator.getAcceptedPermutations(not(removeContainerFromSampleRule),
+                containerDomain,
+                componentDomain, instance);
     }
-
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleParentsTest.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleParentsTest.java
index b3118306058f2a19ecfe2700c14e079967506b50..4c008ea3023d10c92a2caacbb2d15a07aedde2f5 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleParentsTest.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/UpdateSampleParentsTest.java
@@ -30,13 +30,14 @@ import org.testng.annotations.Test;
 import ch.systemsx.cisd.common.exceptions.AuthorizationFailureException;
 import ch.systemsx.cisd.common.exceptions.UserFailureException;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
-import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Sample;
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.Space;
 import ch.systemsx.cisd.openbis.systemtest.base.BaseTest;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.AuthorizationRule;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.GuardedDomain;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.InstanceDomain;
 import ch.systemsx.cisd.openbis.systemtest.base.auth.RolePermutator;
+import ch.systemsx.cisd.openbis.systemtest.base.auth.SpaceDomain;
 
 /**
  * @author anttil
@@ -198,16 +199,22 @@ public class UpdateSampleParentsTest extends BaseTest
     }
 
     @BeforeClass
-    protected void createFixture() throws Exception
+    void createFixture() throws Exception
     {
         space = create(aSpace());
     }
 
+    GuardedDomain spaceDomain;
+
+    GuardedDomain instance;
+
+    AuthorizationRule addParentToSampleRule;
+
     @BeforeClass
     void createAuthorizationRules()
     {
-        spaceDomain = new GuardedDomain("space", RoleLevel.SPACE);
-        instance = new GuardedDomain("instance", RoleLevel.INSTANCE);
+        instance = new InstanceDomain("instance");
+        spaceDomain = new SpaceDomain("space", instance);
 
         addParentToSampleRule =
                 or(
@@ -216,18 +223,10 @@ public class UpdateSampleParentsTest extends BaseTest
                         and(
                                 rule(spaceDomain, RoleWithHierarchy.SPACE_USER),
                                 rule(instance, RoleWithHierarchy.INSTANCE_ETL_SERVER)
-                        ),
-
-                        rule(instance, RoleWithHierarchy.INSTANCE_ADMIN)
+                        )
                 );
     }
 
-    public GuardedDomain spaceDomain;
-
-    public GuardedDomain instance;
-
-    public AuthorizationRule addParentToSampleRule;
-
     @DataProvider
     Object[][] rolesAllowedToAddParentToSample()
     {
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/BasicAuthorizationRule.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/BasicAuthorizationRule.java
index 397ae48937468ece97ee0eb6190ec32a4e644738..45424861bae9de4b580684f74e9d15afd1f09553 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/BasicAuthorizationRule.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/BasicAuthorizationRule.java
@@ -16,7 +16,9 @@
 
 package ch.systemsx.cisd.openbis.systemtest.base.auth;
 
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 
 import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy;
 
@@ -54,14 +56,19 @@ public class BasicAuthorizationRule implements AuthorizationRule
     }
 
     @Override
-    public boolean accepts(Map<GuardedDomain, RoleWithHierarchy> roles)
+    public boolean accepts(Map<GuardedDomain, RoleWithHierarchy> permutation)
     {
-        RoleWithHierarchy role = roles.get(this.domain);
-        if (role == null)
+        Set<RoleWithHierarchy> roles = new HashSet<RoleWithHierarchy>();
+        GuardedDomain current = this.domain;
+        while (current != null)
         {
-            return false;
+            if (this.limit.getRoles().contains(permutation.get(current)))
+            {
+                return true;
+            }
+            current = current.getSuperDomain();
         }
 
-        return this.limit.getRoles().contains(role);
+        return false;
     }
 }
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/GuardedDomain.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/GuardedDomain.java
index fbfbb4309ae5381c0f6563b12b1449c9a917244e..c39957dbf9bb1fe6d7bdf610098f2215eddcd097 100644
--- a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/GuardedDomain.java
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/GuardedDomain.java
@@ -23,7 +23,7 @@ import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleL
 /**
  * @author anttil
  */
-public class GuardedDomain
+public abstract class GuardedDomain
 {
     private final String name;
 
@@ -45,6 +45,8 @@ public class GuardedDomain
         return type;
     }
 
+    public abstract GuardedDomain getSuperDomain();
+
     @Override
     public boolean equals(Object o)
     {
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/InstanceDomain.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/InstanceDomain.java
new file mode 100644
index 0000000000000000000000000000000000000000..1ec97987449f614eadf10e8b60cf07c825f86cdc
--- /dev/null
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/InstanceDomain.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2012 ETH Zuerich, CISD
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ch.systemsx.cisd.openbis.systemtest.base.auth;
+
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
+
+/**
+ * @author anttil
+ */
+public class InstanceDomain extends GuardedDomain
+{
+
+    public InstanceDomain(String name)
+    {
+        super(name, RoleLevel.INSTANCE);
+    }
+
+    @Override
+    public GuardedDomain getSuperDomain()
+    {
+        return null;
+    }
+
+}
diff --git a/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/SpaceDomain.java b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/SpaceDomain.java
new file mode 100644
index 0000000000000000000000000000000000000000..6078017db05b9b8a05f52e1171110553dcbfb822
--- /dev/null
+++ b/openbis/sourceTest/java/ch/systemsx/cisd/openbis/systemtest/base/auth/SpaceDomain.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2012 ETH Zuerich, CISD
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ch.systemsx.cisd.openbis.systemtest.base.auth;
+
+import ch.systemsx.cisd.openbis.generic.shared.basic.dto.RoleWithHierarchy.RoleLevel;
+
+/**
+ * @author anttil
+ */
+public class SpaceDomain extends GuardedDomain
+{
+
+    private GuardedDomain superDomain;
+
+    public SpaceDomain(String name, GuardedDomain instance)
+    {
+        super(name, RoleLevel.SPACE);
+        this.superDomain = instance;
+    }
+
+    @Override
+    public GuardedDomain getSuperDomain()
+    {
+        return this.superDomain;
+    }
+
+}
diff --git a/openbis/sourceTest/java/tests_system_cleandb.xml b/openbis/sourceTest/java/tests_system_cleandb.xml
index f36c919b4b4cdbd388758904cef4badf6535acca..9da769452982fb853bb5b3bc2cc28c6485a5a1e0 100644
--- a/openbis/sourceTest/java/tests_system_cleandb.xml
+++ b/openbis/sourceTest/java/tests_system_cleandb.xml
@@ -6,10 +6,6 @@
   </groups>
   
   <test name="system-cleandb-basic" annotations="JDK">
-    <run>
-      <exclude name="authorization"/>
-    </run>
-  
     <classes>
       <class name="ch.systemsx.cisd.openbis.systemtest.AssignSampleToExperimentTest" />
       <class name="ch.systemsx.cisd.openbis.systemtest.UnassignSampleFromExperimentTest" />
@@ -27,9 +23,6 @@
   </test>
 
   <test name="system-cleandb-stub-relationship-service" annotations="JDK">
-    <run>
-      <exclude name="authorization"/>
-    </run>
     <classes>
       <class name="ch.systemsx.cisd.openbis.systemtest.RelationshipServiceAuthorizationTest" />
     </classes>
diff --git a/openbis/sourceTest/java/tests_system_cleandb_without_authorization.xml b/openbis/sourceTest/java/tests_system_cleandb_without_authorization.xml
new file mode 100644
index 0000000000000000000000000000000000000000..f36c919b4b4cdbd388758904cef4badf6535acca
--- /dev/null
+++ b/openbis/sourceTest/java/tests_system_cleandb_without_authorization.xml
@@ -0,0 +1,38 @@
+<suite name="All" verbose="2" parallel = "false" threadCount = "1">
+  <groups>
+    <run>
+      <include name="system-cleandb"/>
+    </run>
+  </groups>
+  
+  <test name="system-cleandb-basic" annotations="JDK">
+    <run>
+      <exclude name="authorization"/>
+    </run>
+  
+    <classes>
+      <class name="ch.systemsx.cisd.openbis.systemtest.AssignSampleToExperimentTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.UnassignSampleFromExperimentTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.AssignSampleToSpaceTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.UnassignSampleFromSpaceTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.AssignDataSetToSampleTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.AssignDataSetToExperimentTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.AssignExperimentToProjectTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.AssignProjectToSpaceTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.UpdateSampleParentsTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.UpdateSampleContainmentTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.UpdateDataSetParentsTest" />
+      <class name="ch.systemsx.cisd.openbis.systemtest.UpdateDataSetContainmentTest" />
+    </classes>
+  </test>
+
+  <test name="system-cleandb-stub-relationship-service" annotations="JDK">
+    <run>
+      <exclude name="authorization"/>
+    </run>
+    <classes>
+      <class name="ch.systemsx.cisd.openbis.systemtest.RelationshipServiceAuthorizationTest" />
+    </classes>
+  </test>
+  
+</suite>