private boolean canAlterRelation(Collection<String> identifiers)
            throws GuacamoleException {

        // Privileged users (such as system administrators) may alter any
        // relations
        if (getCurrentUser().isPrivileged())
            return true;

        // Non-admin users require UPDATE permission on the parent object ...
        if (!getParentObjectEffectivePermissionSet().hasPermission(
                ObjectPermission.Type.UPDATE, parent.getIdentifier()))
            return false;

        // ... as well as UPDATE permission on all child objects being changed
        Collection<String> accessibleIdentifiers =
                getChildObjectEffectivePermissionSet().getAccessibleObjects(
                        Collections.singleton(ObjectPermission.Type.UPDATE),
                        identifiers);

        return accessibleIdentifiers.size() == identifiers.size();

    }
Returns whether the current user has permission to alter the status of
the relation between the parent object and the given child objects.

@param identifiers
    The identifiers of all objects on the child side of the one-to-many
    relation being changed.

@return
    true if the user has permission to make the described changes,
    false otherwise.

@throws GuacamoleException
    If permission to query permission status is denied.
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RelatedObjectSet.java