code: public Set<PermissionDetails> list(AuthenticatedUser performer, Set<Permission> permissions, IResource resource, String of)
      throws RequestValidationException, RequestExecutionException
      {
          if (!performer.isSuper() && !performer.getName().equals(of))
              throw new UnauthorizedException(String.format("You are not authorized to view %s's permissions",
                                                            of == null ? "everyone" : of));
  
          Set<PermissionDetails> details = new HashSet<PermissionDetails>();
  
          for (UntypedResultSet.Row row : process(buildListQuery(resource, of)))
          {
              if (row.has(PERMISSIONS))
              {
                  for (String p : row.getSet(PERMISSIONS, UTF8Type.instance))
                  {
                      Permission permission = Permission.valueOf(p);
                      if (permissions.contains(permission))
                          details.add(new PermissionDetails(row.getString(USERNAME),
                                                            DataResource.fromName(row.getString(RESOURCE)),
                                                            permission));
                  }
              }
          }
  
          return details;
      }
docs: allowed to see their own permissions.