Good point. Well, the work is being done from the activity list. So, reassigning a user by-passes the normal model layer check of privileges when working in an object's workspace/model. I originally only had this in the model layer's canReassign method but Steve said privs should always be checked on the server as well. Copy/paste. Thoughts?