diff --git a/TODO.txt b/TODO.txt
index 6b7b399..2bf24db 100644
--- a/TODO.txt
+++ b/TODO.txt
@@ -1,3 +1,4 @@
+- FIX: timestamp of automagically detected expire status
 - FIX: validation for first_day
 
 - Test event list export
diff --git a/dav_events/apps.py b/dav_events/apps.py
index 201d3c9..1b56f05 100644
--- a/dav_events/apps.py
+++ b/dav_events/apps.py
@@ -14,6 +14,7 @@ DEFAULT_SETTINGS = (
     DefaultSetting('groups_publisher_print', []),
     DefaultSetting('groups_publisher_web', []),
     DefaultSetting('groups_publisher_facebook', []),
+    DefaultSetting('groups_office', []),
     DefaultSetting('forms_development_init', False),
     DefaultSetting('form_initials', dict()),
     DefaultSetting('matrix_config', ImproperlyConfigured),
diff --git a/dav_events/django_project_config/settings-dav_events.py b/dav_events/django_project_config/settings-dav_events.py
index 7b288f7..a525860 100644
--- a/dav_events/django_project_config/settings-dav_events.py
+++ b/dav_events/django_project_config/settings-dav_events.py
@@ -16,6 +16,7 @@ GROUPS_MANAGER_B = ['Bereichsleiter_Bergsteigen']
 GROUPS_PUBLISHER_PRINT = ['Redaktion_KA-Alpin']
 GROUPS_PUBLISHER_WEB = ['Redaktion_Joomla']
 GROUPS_PUBLISHER_FACEBOOK = ['Redaktion_Facebook']
+GROUPS_OFFICE = ['Geschaeftsstelle']
 
 # ChainedForm and sub classes
 FORM_INITIALS = {
diff --git a/dav_events/templates/dav_events/event_detail.html b/dav_events/templates/dav_events/event_detail.html
index ee51b78..0440de5 100644
--- a/dav_events/templates/dav_events/event_detail.html
+++ b/dav_events/templates/dav_events/event_detail.html
@@ -113,7 +113,7 @@
 <div class="action-tabs top-most">
     <div class="pull-right">
         {% if has_permission_submit %}
-        <a id="btn-submit" class="btn {% if not is_submitted %}btn-success{% else %}btn-default disabled{% endif %}"
+        <a id="btn-submit" class="btn btn-sm {% if not is_submitted %}btn-success{% else %}btn-default disabled{% endif %}"
            data-toggle="modal" data-target="#modal-submit-dialog">
             {% if is_submitted %}
             {% bootstrap_icon 'check' %}&thinsp;
@@ -124,7 +124,7 @@
         </a>
         {% endif %}
         {% if has_permission_accept %}
-        <a id="btn-accept" class="btn {% if is_submitted and not is_accepted %}btn-success{% else %}btn-default disabled{% endif %}"
+        <a id="btn-accept" class="btn btn-sm {% if is_submitted and not is_accepted %}btn-success{% else %}btn-default disabled{% endif %}"
            data-toggle="modal" data-target="#modal-accept-dialog">
             {% if is_accepted %}
             {% bootstrap_icon 'check' %}&thinsp;
@@ -135,7 +135,7 @@
         </a>
         {% endif %}
         {% if has_permission_publish %}
-        <a id="btn-confirmpublication" class="btn {% if is_accepted and not is_publishing and not is_published %}btn-success{% else %}btn-default disabled{% endif %}"
+        <a id="btn-confirmpublication" class="btn btn-sm {% if is_accepted and not is_publishing and not is_published %}btn-success{% else %}btn-default disabled{% endif %}"
            data-toggle="modal" data-target="#modal-confirmpublication-dialog">
             {% if is_publishing_any %}
             {% bootstrap_icon 'check' %}&thinsp;
@@ -145,7 +145,7 @@
             {% trans 'Veröffentlichung bestätigen' %}
         </a>
         {% endif %}
-        <a id="btn-clone" class="btn btn-primary"
+        <a id="btn-clone" class="btn btn-sm btn-primary"
            href="{% url 'dav_events:create' %}?copy={{ event.pk }}"
            title="{% trans 'Diese Veranstaltung als Vorlage für eine neue Veranstaltung benutzen' %}">
             {% bootstrap_icon 'duplicate' %}&thinsp;
@@ -165,10 +165,12 @@
             <a class="btn {% if has_permission_update %}btn-warning{% else %}disabled{% endif %}"
                href="{% url 'dav_events:update' event.pk %}">{% trans 'Ändern' %}</a>
         </li>
-        <li class="{% if not event.registration_required %}disabled{% endif %}">
-            <a class="btn {% if not event.registration_required %}disabled{% elif is_published_any %}btn-warning{% endif %}"
+        {% if event.registration_required %}
+        <li>
+            <a class="btn {% if is_published_any %}btn-success{% endif %}"
                href="{% url 'dav_events:registrations' event.pk %}">{% trans 'Anmeldungen' %}</a>
         </li>
+        {% endif %}
     </ul>
 </div>
 
diff --git a/dav_events/templates/dav_events/event_registrations.html b/dav_events/templates/dav_events/event_registrations.html
index e1c2e5d..3992793 100644
--- a/dav_events/templates/dav_events/event_registrations.html
+++ b/dav_events/templates/dav_events/event_registrations.html
@@ -141,7 +141,7 @@
 <div class="panel panel-default">
     <div class="panel-heading">
         <div class="pull-right">
-            {% render_event_status event show_void=False %}
+            {% render_event_status event %}
         </div>
         <h3 class="panel-title">{{ event }}</h3>
     </div>
@@ -196,6 +196,7 @@
                             </div>
                         </div>
                     </div>
+                    {% if has_permission_update_registration %}
                     <div class="panel-footer">
                         {% if event.is_deadline_expired %}
                         <a id="btn-kill-deadline" class="btn btn-danger"
@@ -217,6 +218,7 @@
                         </a>
                         {% endif %}
                     </div>
+                    {% endif %}
                 </div>
             </div>
         </div>
@@ -241,6 +243,7 @@
                         <form action="" method="post" class="form-inline">
                             {% csrf_token %}
                             <input type="hidden" name="registration" value="{{ registration.id }}">
+                            {% if has_permission_update_participants %}
                             <button type="submit" name="action" value="accept_registration"
                                     class="btn btn-link no-padding" title="zur Teilnehmerliste hinzufügen">
                                 <span class="text-success">{% bootstrap_icon 'plus-sign' %}</span>
@@ -251,6 +254,7 @@
                                 <span class="text-danger">{% bootstrap_icon 'minus-sign' %}</span>
                             </button>
                             &nbsp;
+                            {% endif %}
                             {% if registration.answered %}
                             <span class="text-muted">
                             {% endif %}
@@ -277,6 +281,7 @@
                 </div>
             </div>
             {% endif %}
+            {% if has_permission_update_participants %}
             <div class="panel panel-info">
                 <div id="headingAddParticipant" class="panel-heading" role="tab">
                     <h5 class="panel-title">
@@ -302,6 +307,7 @@
                     </div>
                 </div>
             </div>
+            {% endif %}
             {% if participants %}
             {% for form in participant_formset %}
             {% with participant=form.instance %}
@@ -322,6 +328,7 @@
                             <form action="" method="post" class="form-inline">
                                 {% csrf_token %}
                                 <input type="hidden" name="id" value="{{ participant.id }}">
+                                {% if has_permission_update_participants %}
                                 <button name="action" value="moveup_participant"
                                         title="{% trans 'Nach oben verschieben' %}"
                                         class="btn btn-link no-padding {% if forloop.first %}invisible{% endif %}">
@@ -339,16 +346,29 @@
                                     <span class="text-danger">{% bootstrap_icon 'remove-circle' %}</span>
                                 </button>
                                 &nbsp;
-                                {% if event.charge and participant.paid %}
-                                <span class="text-success" title="Geldeingang bestätigt">
+                                {% endif %}
+                                {% if event.charge and participant.paid and has_permission_payment %}
+                                <button name="action" value="revoke_payment"
+                                        title="{% trans 'Geldeingang wurde bestätigt' %} - {% trans 'Bestätigung des Geldeingangs zurückziehen' %}"
+                                        class="btn btn-link no-padding">
+                                    <span class="text-success">{% bootstrap_icon 'piggy-bank' %}</span>
+                                </button>
+                                {% elif event.charge and participant.paid %}
+                                <span class="text-success" title="{% trans 'Geldeingang bestätigt' %}">
                                     {% bootstrap_icon 'piggy-bank' %}
                                 </span>
+                                {% elif event.charge and has_permission_payment %}
+                                <button name="action" value="confirm_payment"
+                                        title="{% trans 'Geldeingang bestätigen' %}"
+                                        class="btn btn-link no-padding">
+                                    <span class="text-danger">{% bootstrap_icon 'piggy-bank' %}</span>
+                                </button>
                                 {% elif event.charge %}
-                                <span class="text-danger" title="Geldeingang unbestätigt">
+                                <span class="text-danger" title="{% trans 'Geldeingang unbestätigt' %}">
                                     {% bootstrap_icon 'piggy-bank' %}
                                 </span>
                                 {% else %}
-                                <span class="hidden" title="Keine Teilnehmergebühr gefordert">
+                                <span class="hidden" title="{% trans 'Keine Teilnehmergebühr gefordert' %}">
                                     {% bootstrap_icon 'piggy-bank' %}
                                 </span>
                                 {% endif %}
@@ -366,9 +386,11 @@
                             <input type="hidden" name="form_prefix" value="{{ form.prefix }}">
                             <input type="hidden" name="{{ form.prefix }}-id" value="{{ participant.id }}">
                             {% include './includes/participant_form.html' %}
+                            {% if not has_permission_update_participants %}
                             <button type="submit" name="action" value="update_participant" class="btn btn-success">
                                 {% bootstrap_icon 'hdd' %} {% trans 'Speichern' %}
                             </button>
+                            {% endif %}
                         </form>
                     </div>
                 </div>
diff --git a/dav_events/views/events.py b/dav_events/views/events.py
index 58ed074..93338b8 100644
--- a/dav_events/views/events.py
+++ b/dav_events/views/events.py
@@ -48,6 +48,8 @@ class EventListView(generic.ListView):
 
             if has_role(user, 'publisher'):
                 filter |= Q(flags__status__code='accepted')
+            if has_role(user, 'office'):
+                filter |= Q(flags__status__code='submitted')
 
             qs = self.model.objects.filter(filter)
 
@@ -127,8 +129,9 @@ class EventPermissionMixin(object):
         user = self.request.user
         return obj.workflow.has_permission(user, permission)
 
-    def enforce_permission(self, obj):
-        permission = self.permission
+    def enforce_permission(self, obj, permission=None):
+        if permission is None:
+            permission = self.permission
         if not self.has_permission(permission, obj):
             raise PermissionDenied(permission)
 
@@ -162,15 +165,9 @@ class EventDetailView(EventPermissionMixin, generic.DetailView):
 
 
 class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
-    permission = 'update-registration'
     model = models.Event
     template_name = 'dav_events/event_registrations.html'
 
-    def get_object(self, queryset=None):
-        obj = super(EventRegistrationsView, self).get_object(queryset=queryset)
-        self.enforce_permission(obj)
-        return obj
-
     def get_form_kwargs(self, process_request=True):
         kwargs = {}
         if process_request and self.request.method in ('POST', 'PUT'):
@@ -208,6 +205,9 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
         context = super(EventRegistrationsView, self).get_context_data(**kwargs)
         event = context.get('event')
         context['has_permission_update'] = self.has_permission('update', event)
+        context['has_permission_update_registration'] = self.has_permission('update-registration', event)
+        context['has_permission_update_participants'] = self.has_permission('update-participants', event)
+        context['has_permission_payment'] = self.has_permission('payment', event)
         context['is_published_any'] = event.workflow.has_reached_status('published*')
         context['is_done'] = event.workflow.has_reached_status('expired')
 
@@ -304,18 +304,28 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
         participant1.position = pos2
         participant1.save()
 
+    def get(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        self.enforce_permission(self.object, permission='view-participants')
+        context = self.get_context_data(object=self.object)
+        return self.render_to_response(context)
+
     def post(self, request, *args, **kwargs):
-        event = self.get_object()
-        self.object = event
+        self.object = self.get_object()
+        event = self.object
 
         action = request.POST.get('action')
         if action == 'close-registration':
+            self.enforce_permission(event, permission='update-registration')
             self._close_registration(request, event)
         elif action == 'open-registration':
+            self.enforce_permission(event, permission='update-registration')
             self._reopen_registration(request, event)
         elif action == 'kill-deadline':
+            self.enforce_permission(event, permission='update-registration')
             self._kill_deadline(request, event)
         elif action == 'accept_registration':
+            self.enforce_permission(event, permission='update-participants')
             if hasattr(event, 'registrations'):
                 registration_id = request.POST.get('registration')
                 registration = event.registrations.get(id=registration_id)
@@ -323,13 +333,27 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
             else:
                 raise FieldDoesNotExist('Event has no registrations')
         elif action == 'reject_registration':
+            self.enforce_permission(event, permission='update-participants')
             if hasattr(event, 'registrations'):
                 registration_id = request.POST.get('registration')
                 registration = event.registrations.get(id=registration_id)
                 self._reject_registration(registration)
             else:
                 raise FieldDoesNotExist('Event has no registrations')
+        elif action == 'confirm_payment':
+            self.enforce_permission(event, permission='payment')
+            participant_id = request.POST.get('id')
+            participant = event.participants.get(id=participant_id)
+            participant.paid = True
+            participant.save()
+        elif action == 'revoke_payment':
+            self.enforce_permission(event, permission='payment')
+            participant_id = request.POST.get('id')
+            participant = event.participants.get(id=participant_id)
+            participant.paid = False
+            participant.save()
         elif action == 'remove_participant':
+            self.enforce_permission(event, permission='update-participants')
             participant_id = request.POST.get('id')
             participant = event.participants.get(id=participant_id)
             full_name = participant.get_full_name()
@@ -341,6 +365,7 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
                 participant.save()
             messages.success(request, _(u'Teilnehmer gelöscht: {}'.format(full_name)))
         elif action == 'moveup_participant':
+            self.enforce_permission(event, permission='update-participants')
             participant_id = request.POST.get('id')
             participant = event.participants.get(id=participant_id)
             current_position = participant.position
@@ -351,6 +376,7 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
             else:
                 messages.error(request, 'Participant is already on first position')
         elif action == 'movedown_participant':
+            self.enforce_permission(event, permission='update-participants')
             participant_id = request.POST.get('id')
             participant = event.participants.get(id=participant_id)
             current_position = participant.position
@@ -361,6 +387,7 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
             else:
                 messages.error(request, 'Participant is already on last position')
         elif action == 'update_participant':
+            self.enforce_permission(event, permission='update-participants')
             form = self.get_participant_form()
             if form.is_valid():
                 form.save()
@@ -375,6 +402,7 @@ class EventRegistrationsView(EventPermissionMixin, generic.DetailView):
                 messages.error(request, _(u'Ungültige Eingabe - Siehe unten'))
                 return self.render_to_response(self.get_context_data(participant_formset=formset))
         elif action == 'create_participant':
+            self.enforce_permission(event, permission='update-participants')
             form = self.get_participant_form()
             if form.is_valid():
                 form.save()
diff --git a/dav_events/workflow.py b/dav_events/workflow.py
index b723454..2026a03 100644
--- a/dav_events/workflow.py
+++ b/dav_events/workflow.py
@@ -415,6 +415,8 @@ class BasicWorkflow(object):
                 return True
             if has_role(user, 'publisher') and self.has_reached_status('accepted'):
                 return True
+            if has_role(user, 'office') and self.has_reached_status('submitted'):
+                return True
         elif permission == 'submit':
             if user == event.owner:
                 return True
@@ -437,7 +439,7 @@ class BasicWorkflow(object):
                     return True
             elif has_role(user, 'publisher'):
                 return True
-        elif permission == 'update-registration':
+        elif permission == 'view-participants':
             if user == event.owner:
                 return True
             if has_role(user, 'manager_super'):
@@ -446,6 +448,23 @@ class BasicWorkflow(object):
                 return True
             if has_role(user, 'publisher'):
                 return True
+            if has_role(user, 'office'):
+                return True
+        elif permission == 'update-participants':
+            if user == event.owner:
+                return True
+            if has_role(user, 'manager_super'):
+                return True
+        elif permission == 'update-registration':
+            if user == event.owner:
+                return True
+            if has_role(user, 'manager_super'):
+                return True
+            if has_role(user, 'publisher'):
+                return True
+        elif permission == 'payment':
+            if has_role(user, 'office'):
+                return True
         return False
 
     # TODO: is a class method a good idea?