diff --git a/auth/restbackend.py b/auth/restbackend.py
index 5466973..7f6c20b 100644
--- a/auth/restbackend.py
+++ b/auth/restbackend.py
@@ -68,7 +68,12 @@
             return None
             
     def has_perm(self, user_obj, perm):
-        if user_obj.username == "james@example.com":
-            return True
+        if perm == "server_admin":
+            if user_obj.username == "james@example.com":
+                return True
+            else:
+                return False
+        elif perm == "perm": #Test Fallback
+            pass
         else:
-            return False
+            raise Exception(perm+" Permisson unknown")
diff --git a/tests/tests.py b/tests/tests.py
index 707c5fa..83fee7a 100644
--- a/tests/tests.py
+++ b/tests/tests.py
@@ -83,7 +83,21 @@
     True
     
     Check user login directly via our own Auth Framework which will save the Login Cookie which is needed for further testing
-    >>> c.login(username='james@example.com', password='james')
+    >>> c.login(username='katie@example.com', password='katie')
+    True
+    
+Permissions
+=================
+Check that only James does have the permission to get the domains administration
+#TODO - ACL is hardcoded in auth backend : permission domain_admin → == james@...
+    
+    >>> response = c.get('/domains/')
+    >>> print type(response) == HttpResponseRedirect
+    True
+    
+    >>> c.logout() #katie
+
+    >>> c.login(username='james@example.com', password='james') #now Domains should work - see tests below
     True
 
 Create a New Domain
@@ -151,7 +165,7 @@
     >>> response.status_code
     200
     
-    >>> print "Create a new list" in response.content
+    >>> print "Create a new List on" in response.content
     True
 
 Now create a new list called 'new_list'.
diff --git a/views.py b/views.py
index bdd0821..0172bd4 100644
--- a/views.py
+++ b/views.py
@@ -21,7 +21,7 @@
 from django.shortcuts import render_to_response, redirect
 from django.core.urlresolvers import reverse
 from django.utils.translation import gettext as _
-from django.contrib.auth.decorators import login_required
+from django.contrib.auth.decorators import login_required, permission_required
 from django.contrib.auth.models import User
 import re
 from mailman.client import Client
@@ -31,6 +31,7 @@
 from urllib2 import HTTPError
 
 @login_required
+@permission_required('server_admin')
 def domain_index(request, template = 'mailman-django/domain_index.html'):
     try:
         c = Client('http://localhost:8001/3.0', API_USER, API_PASS)
@@ -43,6 +44,7 @@
 					          context_instance=RequestContext(request))  
 
 @login_required
+@permission_required('server_admin')
 def domain_new(request, template = 'mailman-django/domain_new.html'):
     message = None
     if request.method == 'POST':