diff --git a/appview/state/middleware.go b/appview/state/middleware.go
index fb1421df..ce1c3cab 100644
--- a/appview/state/middleware.go
+++ b/appview/state/middleware.go
@@ -152,7 +152,7 @@ func RepoPermissionMiddleware(s *State, requiredPerm string) Middleware {
 				return
 			}
 
-			ok, err := s.enforcer.E.Enforce(actor.Did, f.Knot, f.OwnerSlashRepo(), requiredPerm)
+			ok, err := s.enforcer.E.Enforce(actor.Did, f.Knot, f.DidSlashRepo(), requiredPerm)
 			if err != nil || !ok {
 				// we need a logged in user
 				log.Printf("%s does not have perms of a %s in repo %s", actor.Did, requiredPerm, f.OwnerSlashRepo())
diff --git a/appview/state/repo.go b/appview/state/repo.go
index 256a8783..67509c94 100644
--- a/appview/state/repo.go
+++ b/appview/state/repo.go
@@ -584,7 +584,7 @@ func (s *State) AddCollaborator(w http.ResponseWriter, r *http.Request) {
 		}
 	}()
 
-	err = s.enforcer.AddCollaborator(collaboratorIdent.DID.String(), f.Knot, f.OwnerSlashRepo())
+	err = s.enforcer.AddCollaborator(collaboratorIdent.DID.String(), f.Knot, f.DidSlashRepo())
 	if err != nil {
 		w.Write([]byte(fmt.Sprint("failed to add collaborator: ", err)))
 		return
@@ -677,19 +677,19 @@ func (s *State) DeleteRepo(w http.ResponseWriter, r *http.Request) {
 	}()
 
 	// remove collaborator RBAC
-	repoCollaborators, err := s.enforcer.E.GetImplicitUsersForResourceByDomain(f.OwnerSlashRepo(), f.Knot)
+	repoCollaborators, err := s.enforcer.E.GetImplicitUsersForResourceByDomain(f.DidSlashRepo(), f.Knot)
 	if err != nil {
 		s.pages.Notice(w, "settings-delete", "Failed to remove collaborators")
 		return
 	}
 	for _, c := range repoCollaborators {
 		did := c[0]
-		s.enforcer.RemoveCollaborator(did, f.Knot, f.OwnerSlashRepo())
+		s.enforcer.RemoveCollaborator(did, f.Knot, f.DidSlashRepo())
 	}
 	log.Println("removed collaborators")
 
 	// remove repo RBAC
-	err = s.enforcer.RemoveRepo(f.OwnerDid(), f.Knot, f.OwnerSlashRepo())
+	err = s.enforcer.RemoveRepo(f.OwnerDid(), f.Knot, f.DidSlashRepo())
 	if err != nil {
 		s.pages.Notice(w, "settings-delete", "Failed to update RBAC rules")
 		return
@@ -777,7 +777,7 @@ func (s *State) RepoSettings(w http.ResponseWriter, r *http.Request) {
 
 		isCollaboratorInviteAllowed := false
 		if user != nil {
-			ok, err := s.enforcer.IsCollaboratorInviteAllowed(user.Did, f.Knot, f.OwnerSlashRepo())
+			ok, err := s.enforcer.IsCollaboratorInviteAllowed(user.Did, f.Knot, f.DidSlashRepo())
 			if err == nil && ok {
 				isCollaboratorInviteAllowed = true
 			}
@@ -873,8 +873,13 @@ func (f *FullyResolvedRepo) OwnerSlashRepo() string {
 	return p
 }
 
+func (f *FullyResolvedRepo) DidSlashRepo() string {
+	p, _ := securejoin.SecureJoin(f.OwnerDid(), f.RepoName)
+	return p
+}
+
 func (f *FullyResolvedRepo) Collaborators(ctx context.Context, s *State) ([]pages.Collaborator, error) {
-	repoCollaborators, err := s.enforcer.E.GetImplicitUsersForResourceByDomain(f.OwnerSlashRepo(), f.Knot)
+	repoCollaborators, err := s.enforcer.E.GetImplicitUsersForResourceByDomain(f.DidSlashRepo(), f.Knot)
 	if err != nil {
 		return nil, err
 	}
diff --git a/appview/state/repo_util.go b/appview/state/repo_util.go
index e66ae219..8f29756d 100644
--- a/appview/state/repo_util.go
+++ b/appview/state/repo_util.go
@@ -58,8 +58,7 @@ func fullyResolvedRepo(r *http.Request) (*FullyResolvedRepo, error) {
 
 func RolesInRepo(s *State, u *auth.User, f *FullyResolvedRepo) pages.RolesInRepo {
 	if u != nil {
-		ownerSlashRepo := fmt.Sprintf("%s/%s", f.OwnerDid(), f.RepoName)
-		r := s.enforcer.GetPermissionsInRepo(u.Did, f.Knot, ownerSlashRepo)
+		r := s.enforcer.GetPermissionsInRepo(u.Did, f.Knot, f.DidSlashRepo())
 		return pages.RolesInRepo{r}
 	} else {
 		return pages.RolesInRepo{}