Authorization frustration

I'm having incredible trouble getting my tiny brain around the 
authorization entries.  I'm getting the following exception:
java.lang.SecurityException: Could not run model 
'oscn.prompt-lookupCaseMaster' for role 'org.keel.services.model.Model', 
Service 'org.keel.services.model.Model/oscn.prompt-lookupCaseMaster' Not 
Authorized


I have a user, 'USER1', and a group, "GROUP1", that USER1 belongs to, 
that I need to give full access to this model.  Can someone give me an 
example of the configuration/db entry of the component that I need to 
add to allow this?  Point me to a wiki?  Anything?

the model is configured as:

     <prompt activation="request" logger="oscn" 
id="oscn.prompt-lookupCaseMaster">
       <group>root</group>
       <group>GROUP1</group>
       <input label="" name="appealNumber"/>
       <command label="Find Case" model="oscn.process-findCaseMaster" 
name="find"/>
     </prompt>

sorry to be so daft

gene