code: def object_permission_set(self):
          '''All users have view permissions. Admin users, and users with
          org:admin can create, update, and delete any user. Any user can update
          or delete themselves. Only admins can create or modify other admin
          users.'''
          return Or(
              AllowOnlySafeHttpMethod,
              AllowAdmin,
              And(
                  AllowPermission('org:admin'),
                  ObjAttrTrue(lambda _, u: not u.is_superuser),
                  ObjAttrTrue(
                      lambda r, _: r.data.get('admin') is not True)
              ),
              And(
                  AllowModify,
                  ObjAttrTrue(
                      lambda req, user: user == req.user),
                  ObjAttrTrue(
                      lambda r, _: r.data.get('admin') is not True)
              ),
          f object_permission_set(self):
          '''All users have view permissions. Admin users, and users with
          org:admin can create, update, and delete any user. Any user can update
          or delete themselves. Only admins can create or modify other admin
          users.'''
          return Or(
              AllowOnlySafeHttpMethod,
              AllowAdmin,
              And(
                  AllowPermission('org:admin'),
                  ObjAttrTrue(lambda _, u: not u.is_superuser),
                  ObjAttrTrue(
                      lambda r, _: r.data.get('admin') is not True)
              ),
              And(
                  AllowModify,
                  ObjAttrTrue(
                      lambda req, user: user == req.user),
                  ObjAttrTrue(
                      lambda r, _: r.data.get('admin') is not True)
              ),
          )
docs: All users have view permissions. Admin users, and users with
          org:admin can create, update, and delete any user. Any user can update
          or delete themselves. Only admins can create or modify other admin
          users.