diff --git a/xos/tosca/resources/deployment.py b/xos/tosca/resources/deployment.py
index de7e46d..87b1926 100644
--- a/xos/tosca/resources/deployment.py
+++ b/xos/tosca/resources/deployment.py
@@ -8,7 +8,7 @@
 sys.path.append("/opt/tosca")
 from translator.toscalib.tosca_template import ToscaTemplate
 
-from core.models import User,Deployment,Image,ImageDeployments,Flavor
+from core.models import User,Deployment,DeploymentRole,DeploymentPrivilege,Image,ImageDeployments,Flavor
 
 from xosresource import XOSResource
 
@@ -47,6 +47,9 @@
                     flavor.deployments.add(obj)
                     flavor.save()
 
+        rolemap = ( ("tosca.relationships.AdminPrivilege", "admin"), )
+        self.postprocess_privileges(DeploymentRole, DeploymentPrivilege, rolemap, obj, "deployment")
+
     def delete(self, obj):
         if obj.sites.exists():
             self.info("Deployment %s has active sites; skipping delete" % obj.name)
diff --git a/xos/tosca/resources/slice.py b/xos/tosca/resources/slice.py
index 2b22ae7..2c02365 100644
--- a/xos/tosca/resources/slice.py
+++ b/xos/tosca/resources/slice.py
@@ -38,7 +38,7 @@
 
         rolemap = ( ("tosca.relationships.AdminPrivilege", "admin"), ("tosca.relationships.AccessPrivilege", "access"),
                     ("tosca.relationships.PIPrivilege", "pi"), ("tosca.relationships.TechPrivilege", "tech") )
-        self.postprocess_privileges(SliceRole, SlicePrivilege, rolemap)
+        self.postprocess_privileges(SliceRole, SlicePrivilege, rolemap, obj, "slice")
 
     def create(self):
         nodetemplate = self.nodetemplate
diff --git a/xos/tosca/resources/xosresource.py b/xos/tosca/resources/xosresource.py
index fa0f7d9..989f3a8 100644
--- a/xos/tosca/resources/xosresource.py
+++ b/xos/tosca/resources/xosresource.py
@@ -2,6 +2,8 @@
 import pdb
 import json
 
+from core.models import User
+
 class XOSResource(object):
     xos_base_class = "XOSResource"
     xos_model = None
@@ -85,13 +87,13 @@
     def can_delete(self, obj):
         return True
 
-    def postprocess_privileges(self, roleclass, privclass, rolemap):
+    def postprocess_privileges(self, roleclass, privclass, rolemap, obj, toFieldName):
         for (rel, role) in rolemap:
             for email in self.get_requirements(rel):
                 role = self.get_xos_object(roleclass, role=role)
                 user = self.get_xos_object(User, email=email)
-                if not privclass.objects.filter(user=user, role=role, slice=obj):
-                    sp = privclass(user=user, role=role, slice=obj)
+                if not privclass.objects.filter(user=user, role=role, **{toFieldName: obj}):
+                    sp = privclass(user=user, role=role, **{toFieldName: obj})
                     sp.save()
                     self.info("Added privilege on %s role %s for %s" % (str(obj), str(role), str(user)))