a user who wants to grant another user permission on a thing should have some sort of administrative permission, right?