protected boolean canAlterPermissions(ModeledAuthenticatedUser user,
            ModeledPermissions<? extends EntityModel> targetEntity,
            Collection<ObjectPermission> permissions)
            throws GuacamoleException {

        // Privileged users (such as system administrators) may do anything
        if (user.isPrivileged())
            return true;
        
        // Verify user has update permission on the target entity
        ObjectPermissionSet permissionSet = getRelevantPermissionSet(user.getUser(), targetEntity);
        if (!permissionSet.hasPermission(ObjectPermission.Type.UPDATE, targetEntity.getIdentifier()))
            return false;

        // Produce collection of affected identifiers
        Collection<String> affectedIdentifiers = new HashSet<String>(permissions.size());
        for (ObjectPermission permission : permissions)
            affectedIdentifiers.add(permission.getObjectIdentifier());

        // Determine subset of affected identifiers that we have admin access to
        ObjectPermissionSet affectedPermissionSet = getPermissionSet(user, user.getUser(), user.getEffectiveUserGroups());
        Collection<String> allowedSubset = affectedPermissionSet.getAccessibleObjects(
            Collections.singleton(ObjectPermission.Type.ADMINISTER),
            affectedIdentifiers
        );

        // The permissions can be altered if and only if the set of objects we
        // are allowed to administer is equal to the set of objects we will be
        // affecting.

        return affectedIdentifiers.size() == allowedSubset.size();
        
    }
Determines whether the current user has permission to update the given
target entity, adding or removing the given permissions. Such permission
depends on whether the current user is a system administrator, whether
they have explicit UPDATE permission on the target entity, and whether
they have explicit ADMINISTER permission on all affected objects.
Permission inheritance via user groups is taken into account.

@param user
    The user who is changing permissions.

@param targetEntity
    The entity whose permissions are being changed.

@param permissions
    The permissions that are being added or removed from the target
    entity.

@return
    true if the user has permission to change the target entity's
    permissions as specified, false otherwise.

@throws GuacamoleException
    If an error occurs while checking permission status, or if
    permission is denied to read the current user's permissions.
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/permission/ModeledObjectPermissionService.java