>     760         container._q_access(request, component) # <- extra parameter

I have a _q_access that needs the component and does the following:

component = req.environ['PATH_INFO'][1:].split('/', 1)[0]

This only works because it knows where it lives in the path (always at the
bottom).  If the above doesn't work you could do something like:

p = req.environ['PATH_INFO'][1:].split('/')
component = p[len(publisher.get_namespace_stack())]

... but that could be considered grody and hard to understand.

>     def _q_access(request, name):
>         if request.session.user is None and name == "private_thing":
>             raise AccessError('You must be logged in to access
> "private_thing".')

This I would suggest putting in private_thing.  Then when you add another
access-controlled object you simply have it inherit (or implement directly)
whatever access method and there's no need to add to a growing switch in
_q_access.

I had to do access checks in _q_access since the object for which access must
be checked doesn't exist yet, but I don't know whether that's considered
"quixotic" (I put the login name in the path).