code: public void removeAndSaveUserPermissions(E entity, User user, Permission... permissions) {
          if (entity == null) {
              LOG.error("Could not remove permissions: The passed entity is NULL.");
              return;
          }
  
          // create a set from the passed array
          final HashSet<Permission> permissionsSet = new HashSet<Permission>(Arrays.asList(permissions));
  
          if (permissionsSet == null || permissionsSet.isEmpty()) {
              LOG.error("Could not remove permissions: No permissions have been passed.");
              return;
          }
  
          // get the existing permission
          PermissionCollection userPermissionCollection = entity.getUserPermissions().get(user);
  
          if (userPermissionCollection == null) {
              LOG.error("Could not remove permissions as there is no attached permission collection.");
              return;
          }
  
          Set<Permission> userPermissions = userPermissionCollection.getPermissions();
  
          int originalNrOfPermissions = userPermissions.size();
  
          // remove the passed permissions from the the existing permission collection
          userPermissions.removeAll(permissionsSet);
  
          int newNrOfPermissions = userPermissions.size();
  
          if (newNrOfPermissions == 0) {
              LOG.debug("The permission collection is empty and will thereby be deleted now.");
  
              // remove
              entity.getUserPermissions().remove(user);
              this.saveOrUpdate(entity);
  
              permissionCollectionService.delete(userPermissionCollection);
  
              return;
          }
  
          // only persist if we have "really" removed something
          if (newNrOfPermissions < originalNrOfPermissions) {
              LOG.debug("Removed the following permissions from an existing permission collection: "
                  + permissionsSet);
              // persist the permission collection
              permissionCollectionService.saveOrUpdate(userPermissionCollection);
              LOG.debug("Persisted a permission collection");
          }
      }
docs: This method removes (user) permissions from the passed entity and persists (!)
  the permission collection!
  
  @param entity      The secured entity
  @param user        The user from which the permissions for the entity will be removed
  @param permissions The permissions to remove