code: private void verifyPermissionToGrantRoles(Subject subject, Iterable<RoleIdentifier> roleIds) {
          Set<RoleIdentifier> unauthorizedIds = Sets.newTreeSet();
          boolean anyAuthorized = false;
  
          for (RoleIdentifier roleId : roleIds) {
              // Verify the caller has permission to grant this role
              if (subject.hasPermission(Permissions.grantRole(roleId))) {
                  anyAuthorized = true;
              } else {
                  unauthorizedIds.add(roleId);
              }
          }
  
          if (!unauthorizedIds.isEmpty()) {
              // If the caller was not authorized to assign any of the provided roles raise a generic exception, otherwise
              // the exception provides insight as to which roles were unauthorized.  This provides some helpful feedback
              // where appropriate without exposing potentially exploitable information about whether the subject's API key
              // is valid.
              if (!anyAuthorized) {
                  throw new UnauthorizedException();
              } else {
                  throw new UnauthorizedException("Not authorized for roles: " + Joiner.on(", ").join(unauthorizedIds));
              }
          }
      }
docs: Verifies whether the user has permission to grant all of the provided roles.  If not it throws an UnauthorizedException.
  @throws UnauthorizedException User did not have the permission to grant at least one role.