protected boolean canReadPermissions(ModeledAuthenticatedUser user,
            ModeledPermissions<? extends EntityModel> targetEntity)
            throws GuacamoleException {

        // A user can always read their own permissions
        if (targetEntity.isUser(user.getUser().getIdentifier()))
            return true;
        
        // Privileged users (such as system administrators) may do anything
        if (user.isPrivileged())
            return true;

        // Can read permissions on target entity if explicit READ is granted
        ObjectPermissionSet permissionSet = getRelevantPermissionSet(user.getUser(), targetEntity);
        return permissionSet.hasPermission(ObjectPermission.Type.READ, targetEntity.getIdentifier());

    }
Determines whether the given user can read the permissions currently
granted to the given target entity. If the reading user and the target
entity are not the same, then explicit READ or SYSTEM_ADMINISTER access
is required. Permission inheritance via user groups is taken into account.

@param user
    The user attempting to read permissions.

@param targetEntity
    The entity whose permissions are being read.

@return
    true if permission is granted, false otherwise.

@throws GuacamoleException 
    If an error occurs while checking permission status, or if
    permission is denied to read the current user's permissions.
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/permission/AbstractPermissionService.java