code: protected boolean canAlterPermissions(ModeledAuthenticatedUser user,
              ModeledPermissions<? extends EntityModel> targetEntity,
              Collection<ObjectPermission> permissions)
              throws GuacamoleException {
  
          // A system adminstrator can do anything
          if (user.getUser().isAdministrator())
              return true;
          
          // Verify user has update permission on the target entity
          ObjectPermissionSet permissionSet = getRelevantPermissionSet(user.getUser(), targetEntity);
          if (!permissionSet.hasPermission(ObjectPermission.Type.UPDATE, targetEntity.getIdentifier()))
              return false;
  
          // Produce collection of affected identifiers
          Collection<String> affectedIdentifiers = new HashSet<String>(permissions.size());
          for (ObjectPermission permission : permissions)
              affectedIdentifiers.add(permission.getObjectIdentifier());
  
          // Determine subset of affected identifiers that we have admin access to
          ObjectPermissionSet affectedPermissionSet = getPermissionSet(user, user.getUser(), user.getEffectiveUserGroups());
          Collection<String> allowedSubset = affectedPermissionSet.getAccessibleObjects(
              Collections.singleton(ObjectPermission.Type.ADMINISTER),
              affectedIdentifiers
          );
  
          // The permissions can be altered if and only if the set of objects we
          // are allowed to administer is equal to the set of objects we will be
          // affecting.
  
          return affectedIdentifiers.size() == allowedSubset.size();
          
      }
docs: Determines whether the current user has permission to update the given
  target entity, adding or removing the given permissions. Such permission
  depends on whether the current user is a system administrator, whether
  they have explicit UPDATE permission on the target entity, and whether
  they have explicit ADMINISTER permission on all affected objects.
  Permission inheritance via user groups is taken into account.
  
  @param user
  The user who is changing permissions.
  
  @param targetEntity
  The entity whose permissions are being changed.
  
  @param permissions
  The permissions that are being added or removed from the target
  entity.
  
  @return
  true if the user has permission to change the target entity's
  permissions as specified, false otherwise.
  
  @throws GuacamoleException
  If an error occurs while checking permission status, or if
  permission is denied to read the current user's permissions.