code: def get_allowed_permissions_for(brain_or_object, user=None):
      
      allowed = []
      user = get_user(user)
      obj = api.get_object(brain_or_object)
      for permission in get_mapped_permissions_for(brain_or_object):
          if user.has_permission(permission, obj):
              allowed.append(permission)
      return allowed
docs: Get the allowed permissions for the given object
  
      Code extracted from `IRoleManager.manage_getUserRolesAndPermissions`
  
      :param brain_or_object: Catalog brain or object
      :param user: A user ID, user object or None (for the current user)
      :returns: List of allowed permissions