rather than just asking "does the assigning user have the ability to assign permissions on this kind of object in all cases"