Hi Joe, running mojo 2385, fulltrust, sql2008, asp4

I do have 4 hospitals (builded as subsites) and i need:

1. that every user, when register on one of the sites, is authenticated in all sites
2. that I can define roles that can modify contents, but only in draw mode, for a specific site 
3. that I can define roles that can only approve or deny draw contents for a specific site 

This Is how I set User.config

<!-- ******* multiple sites with folders  -->
        <add key="UseFoldersInsteadOfHostnamesForMultipleSites" value="true" />
        <add key="AllowMultipleSites" value="true" />

<!-- ******* let users register on all sites -->
    <add key="UseRelatedSiteMode" value="true"/>
    <add key="RelatedSiteID" value="1"/>
    <add key="RelatedSiteModeHideRoleManagerInChildSites" value="false"/>


My problem:

• point 1: works great
• point 2: works ok with a workaround (I've created global groups as "site1ContentDraw, site2ContentDraw.. etc".. and in subsites in security settings of specific module and/or pages I've enabled only the specific group needed as "modify in draw mode" 
• point 3: HEEELP.. what I do need is to create 4 groups, each one that can see ONLY the 3 WORKFLOW administration ICONS of his specific site

I can't manage it... is it possible ?? or how can I do it NOT using Content Publishers standard role (because if I use it same users are allowed to approve contents on all sites) ...

Do I something wrong ??  I've read some post around, as for example:
http://www.mojoportal.com/Forums/Thread.aspx?pageid=5&mid=34&ItemID=2&thread=5815
http://www.mojoportal.com/Forums/Thread.aspx?pageid=5&mid=34&ItemID=7&thread=7932


Thank you so much for your help

Michele (from Rome)