diff --git a/planetstack/core/admin.py b/planetstack/core/admin.py
index 9ea1c36..ffa21d9 100644
--- a/planetstack/core/admin.py
+++ b/planetstack/core/admin.py
@@ -394,15 +394,15 @@
     fields = ['backend_status_icon', 'name','deployment','site']
     readonly_fields = ('backend_status_icon', )
 
-class DeploymentPrivilegeInline(PlStackTabularInline):
-    model = DeploymentPrivilege
+class ControllerPrivilegeInline(PlStackTabularInline):
+    model = ControllerPrivilege
     extra = 0
-    suit_classes = 'suit-tab suit-tab-deploymentprivileges'
-    fields = ['backend_status_icon', 'user','role','deployment']
+    suit_classes = 'suit-tab suit-tab-admin-only'
+    fields = ['backend_status_icon', 'user','role','controller']
     readonly_fields = ('backend_status_icon', )
 
     def queryset(self, request):
-        return DeploymentPrivilege.select_by_user(request.user)
+        return ControllerPrivilege.select_by_user(request.user)
 
 class SitePrivilegeInline(PlStackTabularInline):
     model = SitePrivilege
@@ -440,6 +440,24 @@
     def queryset(self, request):
         return SiteDeployments.select_by_user(request.user)
 
+class ControllerSitesInline(PlStackTabularInline):
+    model = ControllerSites
+    extra = 0
+    suit_classes = 'suit-tab suit-tab-admin-only'
+    fields = ['backend_status_icon', 'controller','site']
+    readonly_fields = ('backend_status_icon', )
+
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'site':
+            kwargs['queryset'] = Site.select_by_user(request.user)
+
+        if db_field.name == 'controller':
+            kwargs['queryset'] = Controller.select_by_user(request.user)
+        return super(ControllerSitesInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
+
+    def queryset(self, request):
+        return ControllerSites.select_by_user(request.user)
+
 
 class SlicePrivilegeInline(PlStackTabularInline):
     model = SlicePrivilege
@@ -475,7 +493,16 @@
     verbose_name = "Image Deployments"
     verbose_name_plural = "Image Deployments"
     suit_classes = 'suit-tab suit-tab-imagedeployments'
-    fields = ['backend_status_icon', 'image', 'deployment', 'glance_image_id']
+    fields = ['backend_status_icon', 'image', 'deployment']
+    readonly_fields = ['backend_status_icon']
+
+class ControllerImagesInline(PlStackTabularInline):
+    model = ControllerImages
+    extra = 0
+    verbose_name = "Controller Images"
+    verbose_name_plural = "Controller Images"
+    suit_classes = 'suit-tab suit-tab-admin-only'
+    fields = ['backend_status_icon', 'image', 'controller', 'glance_image_id']
     readonly_fields = ['backend_status_icon', 'glance_image_id']
 
 class SliceRoleAdmin(PlanetStackBaseAdmin):
@@ -575,7 +602,7 @@
         #    a better way...
 
         self.manipulate_m2m_objs(deployment, self.cleaned_data['sites'], deployment.sitedeployments.all(), SiteDeployments, "deployment", "site")
-        self.manipulate_m2m_objs(deployment, self.cleaned_data['images'], deployment.imagedeployments.all(), ImageDeployments, "deployment", "image")
+        self.manipulate_m2m_objs(deployment, self.cleaned_data['images'], deployment.imagedeployments.all(), ControllerImages, "deployment", "image")
 
       self.save_m2m()
 
@@ -594,7 +621,7 @@
     model = Deployment
     fieldList = ['backend_status_text', 'name', 'availability_zone', 'sites', 'images', 'flavors', 'accessControl']
     fieldsets = [(None, {'fields': fieldList, 'classes':['suit-tab suit-tab-sites']})]
-    inlines = [DeploymentPrivilegeInline,NodeInline,TagInline] # ,ImageDeploymentsInline]
+    inlines = [ControllerPrivilegeInline,NodeInline,TagInline] # ,ControllerImagesInline]
     list_display = ['backend_status_icon', 'name']
     list_display_links = ('backend_status_icon', 'name', )
     readonly_fields = ('backend_status_text', )
@@ -762,13 +789,13 @@
             raise forms.ValidationError('slice name must begin with %s' % site.login_base)
         return cleaned_data
 
-class SliceDeploymentsInline(PlStackTabularInline):
-    model = SliceDeployments
+class ControllerSlicesInline(PlStackTabularInline):
+    model = ControllerSlices
     extra = 0
-    verbose_name = "Slice Deployment"
-    verbose_name_plural = "Slice Deployments"
+    verbose_name = "Controller Slices"
+    verbose_name_plural = "Controller Slices"
     suit_classes = 'suit-tab suit-tab-admin-only'
-    fields = ['backend_status_icon', 'deployment', 'tenant_id']
+    fields = ['backend_status_icon', 'controller', 'tenant_id']
     readonly_fields = ('backend_status_icon', )
 
 class SliceAdmin(PlanetStackBaseAdmin):
@@ -779,7 +806,7 @@
     list_display = ('backend_status_icon', 'name', 'site','serviceClass', 'slice_url', 'max_slivers')
     list_display_links = ('backend_status_icon', 'name', )
     inlines = [SlicePrivilegeInline,SliverInline, TagInline, ReservationInline,SliceNetworkInline]
-    admin_inlines = [SliceDeploymentsInline]
+    admin_inlines = [ControllerSlicesInline]
 
     user_readonly_fields = fieldList
 
@@ -821,10 +848,10 @@
             for deployment in flavor.deployments.all():
                 deployment_flavors.append( (deployment.id, flavor.id, flavor.name) )
 
-        deployment_images = []
+        controller_images = []
         for image in Image.objects.all():
-            for imageDeployment in image.imagedeployments.all():
-                deployment_images.append( (imageDeployment.deployment.id, image.id, image.name) )
+            for controller_image in image.controllerimages.all():
+                controller_images.append( (controller_image.controller.id, image.id, image.name) )
 
         site_login_bases = []
         for site in Site.objects.all():
@@ -904,9 +931,9 @@
                ]
     readonly_fields = ('backend_status_text', )
 
-    suit_form_tabs =(('general','Image Details'),('slivers','Slivers'),('imagedeployments','Deployments'))
+    suit_form_tabs =(('general','Image Details'),('slivers','Slivers'),('imagedeployments','Deployments'), ('controllerimages', 'Controllers'))
 
-    inlines = [SliverInline, ImageDeploymentsInline]
+    inlines = [SliverInline, ControllerImagesInline]
 
     user_readonly_fields = ['name', 'disk_format', 'container_format']
 
@@ -1085,7 +1112,7 @@
     # that reference specific fields on auth.User.
     list_display = ('email', 'firstname', 'lastname', 'site', 'last_login')
     list_filter = ('site',)
-    inlines = [SlicePrivilegeInline,SitePrivilegeInline,DeploymentPrivilegeInline,UserDashboardViewInline]
+    inlines = [SlicePrivilegeInline,SitePrivilegeInline,ControllerPrivilegeInline,UserDashboardViewInline]
 
     fieldListLoginDetails = ['backend_status_text', 'email','site','password','is_active','is_readonly','is_admin','public_key']
     fieldListContactInfo = ['firstname','lastname','phone','timezone']
@@ -1118,7 +1145,7 @@
                          ('contact','Contact Information'),
                          ('sliceprivileges','Slice Privileges'),
                          ('siteprivileges','Site Privileges'),
-                         ('deploymentprivileges','Deployment Privileges'),
+                         ('controllerprivileges','Controller Privileges'),
                          ('dashboards','Dashboard Views'))
 
     def formfield_for_foreignkey(self, db_field, request, **kwargs):
@@ -1339,13 +1366,13 @@
     fields = ['backend_status_icon', 'network','slice']
     readonly_fields = ('backend_status_icon', )
 
-class NetworkDeploymentsInline(PlStackTabularInline):
-    model = NetworkDeployments
+class ControllerNetworksInline(PlStackTabularInline):
+    model = ControllerNetworks
     extra = 0
-    verbose_name_plural = "Network Deployments"
-    verbose_name = "Network Deployment"
+    verbose_name_plural = "Controller Networks"
+    verbose_name = "Controller Network"
     suit_classes = 'suit-tab suit-tab-admin-only'
-    fields = ['backend_status_icon', 'deployment','net_id','subnet_id']
+    fields = ['backend_status_icon', 'controller','net_id','subnet_id']
     readonly_fields = ('backend_status_icon', )
 
 class NetworkForm(forms.ModelForm):
@@ -1362,7 +1389,7 @@
     readonly_fields = ("subnet", )
 
     inlines = [NetworkParameterInline, NetworkSliversInline, NetworkSlicesInline, RouterInline]
-    admin_inlines = [NetworkDeploymentsInline]
+    admin_inlines = [ControllerNetworksInline]
 
     form=NetworkForm
 
@@ -1544,6 +1571,7 @@
 showAll = False
 
 admin.site.register(Deployment, DeploymentAdmin)
+admin.site.register(Controller, ControllerAdmin)
 admin.site.register(Site, SiteAdmin)
 admin.site.register(Slice, SliceAdmin)
 admin.site.register(Service, ServiceAdmin)
@@ -1559,7 +1587,7 @@
     admin.site.register(ServiceClass, ServiceClassAdmin)
     #admin.site.register(PlanetStack)
     admin.site.register(Tag, TagAdmin)
-    admin.site.register(DeploymentRole)
+    admin.site.register(ControllerRole)
     admin.site.register(SiteRole)
     admin.site.register(SliceRole)
     admin.site.register(PlanetStackRole)
diff --git a/planetstack/core/models/__init__.py b/planetstack/core/models/__init__.py
index ae5c89b..423fe0b 100644
--- a/planetstack/core/models/__init__.py
+++ b/planetstack/core/models/__init__.py
@@ -5,14 +5,14 @@
 from .service import ServiceAttribute
 from .tag import Tag
 from .role import Role
-from .site import Site,Deployment, DeploymentRole, DeploymentPrivilege, SiteDeployments, ControllerSites
+from .site import Site, Deployment, Controller, ControllerRole, ControllerPrivilege, SiteDeployments, ControllerSites
 from .dashboard import DashboardView
 from .user import User, UserDashboardView
 from .serviceclass import ServiceClass
 from .site import ControllerLinkManager,ControllerLinkDeletionManager
 from .slice import Slice, ControllerSlices
 from .controllerusers import ControllerUsers
-from .image import Image, ControllerImages
+from .image import Image, ImageDeployments, ControllerImages
 from .node import Node
 from .serviceresource import ServiceResource
 from .slice import SliceRole
diff --git a/planetstack/core/models/controllerusers.py b/planetstack/core/models/controllerusers.py
new file mode 100644
index 0000000..5a3568a
--- /dev/null
+++ b/planetstack/core/models/controllerusers.py
@@ -0,0 +1,26 @@
+import os
+import datetime
+from collections import defaultdict
+from django.db import models
+from django.db.models import F, Q
+from core.models import PlCoreBase,User,Controller
+from core.models import Controller,ControllerLinkManager,ControllerLinkDeletionManager
+
+class ControllerUsers(PlCoreBase):
+    objects = ControllerLinkManager()
+    deleted_objects = ControllerLinkDeletionManager()
+
+    user = models.ForeignKey(User,related_name='controllerusers')
+    controller = models.ForeignKey(Controller,related_name='controllersusers')
+    kuser_id = models.CharField(null=True, blank=True, max_length=200, help_text="Keystone user id")
+
+    def __unicode__(self):  return u'%s %s' % (self.controller, self.user)
+
+    @staticmethod
+    def select_by_user(user):
+        if user.is_admin:
+            qs = ControllerUsers.objects.all()
+        else:
+            users = Users.select_by_user(user)
+            qs = ControllerUsers.objects.filter(user__in=users)
+        return qs
diff --git a/planetstack/core/models/credential.py b/planetstack/core/models/credential.py
index b74e540..0f80bb8 100644
--- a/planetstack/core/models/credential.py
+++ b/planetstack/core/models/credential.py
@@ -1,9 +1,9 @@
 import os
 from django.db import models
 from core.models import PlCoreBase
-from core.models import User,Site,Slice,Deployment
+from core.models import User,Site,Slice,Controller
 from encrypted_fields import EncryptedCharField
-from core.models import Deployment,DeploymentLinkManager,DeploymentLinkDeletionManager
+from core.models import Controller,ControllerLinkManager,ControllerLinkDeletionManager
 
 class UserCredential(PlCoreBase):
     user = models.ForeignKey(User, related_name='usercredentials', help_text="The User this credential is associated with")
@@ -38,10 +38,10 @@
     def __unicode__(self):
         return self.name
 
-class DeploymentCredential(PlCoreBase):
-    objects = DeploymentLinkManager()
-    deleted_objects = DeploymentLinkDeletionManager()
-    deployment = models.ForeignKey(Deployment, related_name='deploymentcredentials', help_text="The User this credential is associated with")
+class ControllerCredential(PlCoreBase):
+    objects = ControllerLinkManager()
+    deleted_objects = ControllerLinkDeletionManager()
+    controller = models.ForeignKey(Controller, related_name='controllercredentials', help_text="The User this credential is associated with")
 
     name = models.SlugField(help_text="The credential type, e.g. ec2", max_length=128)
     key_id = models.CharField(help_text="The backend id of this credential", max_length=1024)
diff --git a/planetstack/core/models/image.py b/planetstack/core/models/image.py
index a7b63b6..4399c60 100644
--- a/planetstack/core/models/image.py
+++ b/planetstack/core/models/image.py
@@ -1,7 +1,7 @@
 import os
 from django.db import models
 from core.models import PlCoreBase
-from core.models import Controller,ControllerLinkManager,ControllerLinkDeletionManager
+from core.models import Deployment,Controller,ControllerLinkManager,ControllerLinkDeletionManager
 
 # Create your models here.
 
@@ -13,6 +13,12 @@
 
     def __unicode__(self):  return u'%s' % (self.name)
 
+class ImageDeployments(PlCoreBase):
+    image = models.ForeignKey(Image,related_name='imagedeployments')
+    deployment = models.ForeignKey(Deployment,related_name='imagedeployments')
+
+    def __unicode__(self):  return u'%s %s' % (self.image, self.deployment)
+
 class ControllerImages(PlCoreBase):
     objects = ControllerLinkManager()
     deleted_objects = ControllerLinkDeletionManager()
diff --git a/planetstack/core/models/node.py b/planetstack/core/models/node.py
index 903c25f..6ef3a47 100644
--- a/planetstack/core/models/node.py
+++ b/planetstack/core/models/node.py
@@ -1,7 +1,7 @@
 import os
 from django.db import models
 from core.models import PlCoreBase
-from core.models import SiteDeployment, Controller
+from core.models import SiteDeployments, Controller
 from core.models import Tag
 from django.contrib.contenttypes import generic
 
@@ -9,7 +9,7 @@
 
 class Node(PlCoreBase):
     name = models.CharField(max_length=200, unique=True, help_text="Name of the Node")
-    site_deployment = models.ForeignKey(SiteDeployment, related_name='nodes')
+    site_deployment = models.ForeignKey(SiteDeployments, related_name='nodes')
     tags = generic.GenericRelation(Tag)
 
     def __unicode__(self):  return u'%s' % (self.name)
diff --git a/planetstack/core/models/site.py b/planetstack/core/models/site.py
index 5381a08..ae07fc0 100644
--- a/planetstack/core/models/site.py
+++ b/planetstack/core/models/site.py
@@ -12,7 +12,7 @@
 
 class ControllerLinkDeletionManager(PlCoreBaseDeletionManager):
     def get_queryset(self):
-        parent=super(DeploymentLinkDeletionManager, self)
+        parent=super(ControllerLinkDeletionManager, self)
         try:
             backend_type = config.observer_backend_type
         except AttributeError:
@@ -72,7 +72,7 @@
 
 class ControllerManager(PlCoreBaseManager):
     def get_queryset(self):
-        parent=super(DeploymentManager, self)
+        parent=super(ControllerManager, self)
 
         try:
             backend_type = config.observer_backend_type
@@ -166,7 +166,7 @@
         return qs
 
 class Deployment(PlCoreBase):
-    #objects = DeploymentManager()
+    #objects = Controllermanager()
     #deleted_objects = DeploymentDeletionManager()
     name = models.CharField(max_length=200, unique=True, help_text="Name of the Deployment")
     #admin_user = models.CharField(max_length=200, null=True, blank=True, help_text="Username of an admin user at this deployment")
@@ -217,8 +217,8 @@
     def __unicode__(self):  return u'%s' % (self.name)
 
 class ControllerRole(PlCoreBase):
-    #objects = DeploymentLinkManager()
-    #deleted_objects = DeploymentLinkDeletionManager()
+    #objects = ControllerLinkManager()
+    #deleted_objects = ControllerLinkDeletionManager()
 
     ROLE_CHOICES = (('admin','Admin'),)
     role = models.CharField(choices=ROLE_CHOICES, unique=True, max_length=30)
@@ -256,8 +256,8 @@
         return qs 
 
 class SiteDeployments(PlCoreBase):
-    #objects = DeploymentLinkManager()
-    #deleted_objects = DeploymentLinkDeletionManager()
+    #objects = ControllerLinkManager()
+    #deleted_objects = ControllerLinkDeletionManager()
     objects = ControllerManager()
     deleted_objects = ControllerDeletionManager()
 
diff --git a/planetstack/core/models/sliver.py b/planetstack/core/models/sliver.py
index c4789d6..c4449fe 100644
--- a/planetstack/core/models/sliver.py
+++ b/planetstack/core/models/sliver.py
@@ -17,13 +17,13 @@
 
 config = Config()
 
-def get_default_flavor(deployment = None):
+def get_default_flavor(controller = None):
     # Find a default flavor that can be used for a sliver. This is particularly
     # useful in evolution. It's also intended this helper function can be used
     # for admin.py when users
 
-    if deployment:
-        flavors = deployment.flavors.all()
+    if controller:
+        flavors = controller.flavors.all()
     else:
         flavors = Flavor.objects.all()
 
@@ -88,7 +88,7 @@
     creator = models.ForeignKey(User, related_name='slivers', blank=True, null=True)
     slice = models.ForeignKey(Slice, related_name='slivers')
     node = models.ForeignKey(Node, related_name='slivers')
-    deploymentNetwork = models.ForeignKey(Deployment, verbose_name='deployment', related_name='sliver_deploymentNetwork')
+    controllerNetwork = models.ForeignKey(Deployment, verbose_name='controller', related_name='sliver_controllerNetwork')
     numberCores = models.IntegerField(verbose_name="Number of Cores", help_text="Number of cores for sliver", default=0)
     flavor = models.ForeignKey(Flavor, help_text="Flavor of this instance", default=get_default_flavor)
     tags = generic.GenericRelation(Tag)
@@ -108,11 +108,11 @@
         self.name = self.slice.slicename
         if not self.creator and hasattr(self, 'caller'):
             self.creator = self.caller
-        self.deploymentNetwork = self.node.deployment
+        self.controllerNetwork = self.node.controller
 
 # XXX smbaker - disabled for now, was causing fault in tenant view create slice
-#        if not self.deploymentNetwork.test_acl(slice=self.slice):
-#            raise exceptions.ValidationError("Deployment %s's ACL does not allow any of this slice %s's users" % (self.deploymentNetwork.name, self.slice.name))
+#        if not self.controllerNetwork.test_acl(slice=self.slice):
+#            raise exceptions.ValidationError("Deployment %s's ACL does not allow any of this slice %s's users" % (self.controllerNetwork.name, self.slice.name))
 
         super(Sliver, self).save(*args, **kwds)