code: protected void beforeCreate(ModeledAuthenticatedUser user,
              ExternalType object, ModelType model) throws GuacamoleException {
  
          // Verify permission to create objects
          if (!user.getUser().isAdministrator() && !hasCreatePermission(user))
              throw new GuacamoleSecurityException("Permission denied.");
  
      }
docs: Called before any object is created through this directory object
  service. This function serves as a final point of validation before
  the create operation occurs. In its default implementation,
  beforeCreate() performs basic permissions checks.
  
  @param user
  The user creating the object.
  
  @param object
  The object being created.
  
  @param model
  The model of the object being created.
  
  @throws GuacamoleException
  If the object is invalid, or an error prevents validating the given
  object.