diff --git a/common/python/rift/mano/sdn/config.py b/common/python/rift/mano/sdn/config.py
index 20b17cc..1ae65a5 100644
--- a/common/python/rift/mano/sdn/config.py
+++ b/common/python/rift/mano/sdn/config.py
@@ -78,9 +78,10 @@
 class SDNAccountConfigSubscriber(object):
     XPATH = "C,/rw-sdn:sdn/rw-sdn:account"
 
-    def __init__(self, dts, log, rwlog_hdl, sdn_callbacks, acctstore):
+    def __init__(self, dts, log, project, rwlog_hdl, sdn_callbacks, acctstore):
         self._dts = dts
         self._log = log
+        self._project = project
         self._rwlog_hdl = rwlog_hdl
         self._reg = None
 
@@ -205,8 +206,9 @@
 
             xact_info.respond_xpath(rwdts.XactRspCode.ACK)
 
+        xpath = self._project.add_project(SDNAccountConfigSubscriber.XPATH)
         self._log.debug("Registering for SDN Account config using xpath: %s",
-                        SDNAccountConfigSubscriber.XPATH,
+                        xpath,
                         )
 
         acg_handler = rift.tasklets.AppConfGroup.Handler(
@@ -215,7 +217,7 @@
 
         with self._dts.appconf_group_create(acg_handler) as acg:
             self._reg = acg.register(
-                    xpath=SDNAccountConfigSubscriber.XPATH,
+                    xpath=xpath,
                     flags=rwdts.Flag.SUBSCRIBER | rwdts.Flag.DELTA_READY | rwdts.Flag.CACHE,
                     on_prepare=on_prepare,
                     )
diff --git a/common/python/rift/mano/sdn/operdata.py b/common/python/rift/mano/sdn/operdata.py
index 094d804..732c600 100644
--- a/common/python/rift/mano/sdn/operdata.py
+++ b/common/python/rift/mano/sdn/operdata.py
@@ -29,10 +29,11 @@
 
 
 class SDNAccountDtsOperdataHandler(object):
-    def __init__(self, dts, log, loop):
+    def __init__(self, dts, log, loop, project):
         self._dts = dts
         self._log = log
         self._loop = loop
+        self._project = project
 
         self.sdn_accounts = {}
         self._oper = None
@@ -63,9 +64,10 @@
 
     def _register_show_status(self):
         def get_xpath(sdn_name=None):
-            return "D,/rw-sdn:sdn/account{}/connection-status".format(
-                    "[name='%s']" % sdn_name if sdn_name is not None else ''
-                    )
+            return self._project.add_project("D,/rw-sdn:sdn/account{}/connection-status".
+                                             format(
+                                                 "[name='%s']" % sdn_name
+                                                 if sdn_name is not None else ''))
 
         @asyncio.coroutine
         def on_prepare(xact_info, action, ks_path, msg):
diff --git a/common/python/rift/mano/utils/project.py b/common/python/rift/mano/utils/project.py
index 9157f89..96d1de5 100644
--- a/common/python/rift/mano/utils/project.py
+++ b/common/python/rift/mano/utils/project.py
@@ -651,12 +651,14 @@
         except Exception as e:
             self._log.exception("Project {} create for {} failed: {}".
                                 format(name, self._get_tasklet_name(), e))
+            raise e
 
         try:
             yield from self._get_project(name).register()
         except Exception as e:
             self._log.exception("Project {} register for tasklet {} failed: {}".
                                 format(name, self._get_tasklet_name(), e))
+            raise e
 
     @asyncio.coroutine
     def on_delete_prepare(self, name):
diff --git a/models/plugins/yang/nsr.role.xml b/models/plugins/yang/nsr.role.xml
index 4353911..0548c7b 100644
--- a/models/plugins/yang/nsr.role.xml
+++ b/models/plugins/yang/nsr.role.xml
@@ -19,6 +19,7 @@
       <permissions>read execute</permissions>
       <path>/rw-project:project/nsr:ns-instance-config</path>
       <path>/rw-project:project/nsr:ns-instance-opdata</path>
+      <path>/rw-project:project/nsr:key-pair</path>
     </authorize>
   </role-definition>
 
@@ -29,6 +30,7 @@
       <permissions>create read update delete execute</permissions>
       <path>/rw-project:project/nsr:ns-instance-config</path>
       <path>/rw-project:project/nsr:ns-instance-opdata</path>
+      <path>/rw-project:project/nsr:key-pair</path>
       <path>/nsr:exec-scale-out</path>
       <path>/nsr:exec-scale-in</path>
       <path>/nsr:exec-ns-service-primitive</path>
diff --git a/models/plugins/yang/nsr.yang b/models/plugins/yang/nsr.yang
index 50bbc0d..efddc77 100644
--- a/models/plugins/yang/nsr.yang
+++ b/models/plugins/yang/nsr.yang
@@ -112,7 +112,7 @@
       leaf key-pair-ref {
         description "A reference to the key pair entry in the global key pair table";
         type leafref {
-          path "/nsr:key-pair/nsr:name";
+          path "../../../../key-pair/name";
         }
       }
     }
@@ -137,28 +137,13 @@
         leaf key-pair-ref {
           description "A reference to the key pair entry in the global key pair table";
           type leafref {
-            path "/nsr:key-pair/nsr:name";
+            path "../../../../../key-pair/nsr:name";
           }
         }
       }
     }
   }
 
-  list key-pair {
-    key "name";
-    description "Used to configure the list of public keys to be injected as part
-                 of ns instantiation";
-    leaf name {
-      description "Name of this key pair";
-      type string;
-    }
-
-    leaf key {
-      description "Key associated with this key pair";
-      type string;
-    }
-  }
-
   augment "/rw-project:project" {
     list key-pair {
       key "name";
diff --git a/rwcal/plugins/vala/CMakeLists.txt b/rwcal/plugins/vala/CMakeLists.txt
index 7ef9879..9cf53f9 100644
--- a/rwcal/plugins/vala/CMakeLists.txt
+++ b/rwcal/plugins/vala/CMakeLists.txt
@@ -35,7 +35,7 @@
   VALA_PACKAGES
     rw_types-1.0 rw_yang-1.0 rw_keyspec-1.0 rw_yang_pb-1.0 rw_schema_proto-1.0
     rw_log_yang-1.0 rw_base_yang-1.0 rwcal_yang-1.0 rw_manifest_yang-1.0 protobuf_c-1.0 ietf_netconf_yang-1.0
-    rw_log-1.0 rw_project_yang-1.0
+    rw_log-1.0 rw_project_yang-1.0 rw_user_yang-1.0
   VAPI_DIRS ${RIFT_SUBMODULE_BINARY_ROOT}/rwcal/plugins/yang
             ${RIFT_SUBMODULE_BINARY_ROOT}/models/plugins/yang
             ${RIFT_SUBMODULE_BINARY_ROOT}/rwvcs/plugins/yang
diff --git a/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/publisher/copy_status.py b/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/publisher/copy_status.py
index 927331c..1fc6801 100644
--- a/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/publisher/copy_status.py
+++ b/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/publisher/copy_status.py
@@ -34,16 +34,16 @@
 
 class CopyStatusPublisher(mano_dts.DtsHandler, url_downloader.DownloaderProtocol): 
 
-    def __init__(self, log, dts, loop, tasklet_info):
-        super().__init__(log, dts, loop) 
-        self.tasks = {} 
-        self.tasklet_info = tasklet_info
+    def __init__(self, log, dts, loop, project):
+        super().__init__(log, dts, loop, project)
+        self.tasks = {}
+        self.tasklet_info = project.tasklet.tasklet_info
 
     def xpath(self, transaction_id=None):
-        return ("D,/rw-pkg-mgmt:copy-jobs/rw-pkg-mgmt:job" +
+        return self.project.add_project("D,/rw-pkg-mgmt:copy-jobs/rw-pkg-mgmt:job" +
             ("[transaction-id='{}']".format(transaction_id) if transaction_id else ""))
         pass
-    
+
     @asyncio.coroutine
     def register(self):
         self.reg = yield from self.dts.register(xpath=self.xpath(),
diff --git a/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rpc.py b/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rpc.py
index d360640..e05a042 100644
--- a/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rpc.py
+++ b/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rpc.py
@@ -68,12 +68,12 @@
 class SchemaRpcHandler(mano_dts.AbstractRpcHandler):
     """RPC handler to generate the schema for the packages.
     """
-    def __init__(self, log, dts, loop, project, proxy):
+    def __init__(self, log, dts, loop, proxy):
         """
         Args:
             proxy: Any impl of .proxy.AbstractPackageManagerProxy
         """
-        super().__init__(log, dts, loop, project)
+        super().__init__(log, dts, loop)
         self.proxy = proxy
 
     @property
diff --git a/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rwpkgmgr.py b/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rwpkgmgr.py
index 0fcabe3..438f9de 100644
--- a/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rwpkgmgr.py
+++ b/rwlaunchpad/plugins/rwpkgmgr/rift/tasklets/rwpkgmgr/rwpkgmgr.py
@@ -40,7 +40,7 @@
 from . import rpc
 from .proxy import filesystem
 from . import publisher as pkg_publisher
-from . import subscriber 
+from . import subscriber
 
 class PackageManagerProject(ManoProject):
 
@@ -51,22 +51,26 @@
 
         args = [self.log, self.dts, self.loop, self]
         self.job_handler = pkg_publisher.DownloadStatusPublisher(*args)
-        self.copy_publisher = pkg_publisher.CopyStatusPublisher(*args + [self.tasklet.tasklet_info])
+        self.copy_publisher = pkg_publisher.CopyStatusPublisher(*args)
 
-        # create catalog subscribers 
+        # create catalog subscribers
         self.vnfd_catalog_sub = subscriber.VnfdStatusSubscriber(*args)
         self.nsd_catalog_sub = subscriber.NsdStatusSubscriber(*args)
-        
+
         args.append(proxy)
         self.copy_rpc = rpc.PackageCopyOperationsRpcHandler(*(args + [self.copy_publisher]))
 
     @asyncio.coroutine
     def register (self):
-        yield from self.vnfd_catalog_sub.register()
-        yield from self.nsd_catalog_sub.register()
-        yield from self.copy_rpc.register()
-        yield from self.copy_publisher.register()
-        yield from self.job_handler.register()
+        try:
+            yield from self.vnfd_catalog_sub.register()
+            yield from self.nsd_catalog_sub.register()
+            yield from self.copy_rpc.register()
+            yield from self.copy_publisher.register()
+            yield from self.job_handler.register()
+        except Exception as e:
+            self.log.exception("Exception registering project {}: {}".
+                               format(self.name, e))
 
     def deregister (self):
         yield from self.job_handler.deregister()
@@ -135,7 +139,6 @@
         yield from self.delete_rpc.register()
 
         self.log.debug("creating project handler")
-        self.project_handler = ProjectHandler(self, PackageManagerProject)
         self.project_handler.register()
 
     @asyncio.coroutine
diff --git a/rwlaunchpad/plugins/rwvns/vala/CMakeLists.txt b/rwlaunchpad/plugins/rwvns/vala/CMakeLists.txt
index d3aa299..81e8ec4 100644
--- a/rwlaunchpad/plugins/rwvns/vala/CMakeLists.txt
+++ b/rwlaunchpad/plugins/rwvns/vala/CMakeLists.txt
@@ -36,7 +36,7 @@
     rw_log_yang-1.0 rw_base_yang-1.0 rwcal_yang-1.0 rwsdnal_yang-1.0 rw_manifest_yang-1.0 protobuf_c-1.0 ietf_netconf_yang-1.0
     ietf_network_yang-1.0 ietf_network_topology_yang-1.0
     ietf_l2_topology_yang-1.0 rw_topology_yang-1.0
-    rw_log-1.0 rw_project_yang-1.0
+    rw_log-1.0 rw_project_yang-1.0 rw_user_yang-1.0
   VAPI_DIRS 
     ${RIFT_SUBMODULE_BINARY_ROOT}/models/plugins/yang
     ${RIFT_SUBMODULE_BINARY_ROOT}/rwcal/plugins/yang
diff --git a/rwmon/plugins/vala/CMakeLists.txt b/rwmon/plugins/vala/CMakeLists.txt
index 5fd03fc..a30179e 100644
--- a/rwmon/plugins/vala/CMakeLists.txt
+++ b/rwmon/plugins/vala/CMakeLists.txt
@@ -35,7 +35,7 @@
   VALA_PACKAGES
     rw_types-1.0 rw_yang-1.0 rw_keyspec-1.0 rw_yang_pb-1.0 rw_schema_proto-1.0
     rw_log_yang-1.0 rw_base_yang-1.0 rwmon_yang-1.0 rw_manifest_yang-1.0 protobuf_c-1.0 ietf_netconf_yang-1.0
-    rw_log-1.0 rwcal_yang-1.0 rw_project_yang-1.0
+    rw_log-1.0 rwcal_yang-1.0 rw_project_yang-1.0 rw_user_yang-1.0
   VAPI_DIRS ${RIFT_SUBMODULE_BINARY_ROOT}/rwmon/plugins/yang
             ${RIFT_SUBMODULE_BINARY_ROOT}/rwcal/plugins/yang
             ${RIFT_SUBMODULE_BINARY_ROOT}/models/plugins/yang
diff --git a/rwprojectmano/plugins/rwprojectmano/rift/tasklets/rwprojectmano/rolesmano.py b/rwprojectmano/plugins/rwprojectmano/rift/tasklets/rwprojectmano/rolesmano.py
index 0083c06..2988a20 100644
--- a/rwprojectmano/plugins/rwprojectmano/rift/tasklets/rwprojectmano/rolesmano.py
+++ b/rwprojectmano/plugins/rwprojectmano/rift/tasklets/rwprojectmano/rolesmano.py
@@ -60,6 +60,7 @@
 
         self.users = {}
         self.pub = RoleConfigPublisher(project)
+        self.proj_roles = [role['mano-role'] for role in MANO_PROJECT_ROLES]
 
     def get_xpath(self):
         return "C,/{}[name='{}']/project-config/user".format(NS_PROJECT, self.project_name)
@@ -201,6 +202,17 @@
                     self._log.debug("User {}: on_prepare add request".
                                     format(user.key))
 
+                for role in msg.mano_role:
+                    if role.role not in self.proj_roles:
+                        errmsg = "Invalid MANO role {} for user {}". \
+                                 format(role.role, user.key)
+                        self._log.error(errmsg)
+                        xact_info.send_error_xpath(RwTypes.RwStatus.FAILURE,
+                                                   self.get_xpath(),
+                                                   errmsg)
+                        xact_info.respond_xpath(rwdts.XactRspCode.NACK)
+                        return
+
             elif action == rwdts.QueryAction.DELETE:
                 # Check if the user got deleted
                 fref = ProtobufC.FieldReference.alloc()