code: def can_update(self, user, **kwargs):
          
          if user.is_admin():
              raise Return((True, set([])))
  
          is_creator = self.created_by == user.id
          if user.is_org_admin(self.organisation_id) or is_creator:
              fields = set([])
              if 'organisation_id' in kwargs:
                  fields.add('organisation_id')
  
              if fields:
                  raise Return((False, fields))
              else:
                  raise Return((True, set([])))
  
          try:
              service = yield Service.get(self.service_id)
  
              if user.is_org_admin(service.organisation_id):
                  fields = set(kwargs) - {'state'}
                  if fields:
                      raise Return((False, fields))
                  else:
                      raise Return((True, fields))
          except couch.NotFound:
              # will be handled in Repository.validate
              pass
  
          raise Return((False, set([])))
docs: Sys admin's can change anything
  
          If the user is an organisation administrator or created the repository,
          they may change any field other than "organisation_id"
  
          If the user is a service administrator the user may change the "state"
          but no other fields.