3171: Fix wording, update docs.

[arvados.git] / doc / api / permission-model.html.textile.liquid

diff --git a/doc/api/permission-model.html.textile.liquid b/doc/api/permission-model.html.textile.liquid
index bdfdbd70ebd2eb55d07526dacccef5ee2a188563..8b085ee5aaffd1a99c27a0350a134a38f31a269b 100644 (file)
--- a/doc/api/permission-model.html.textile.liquid
+++ b/doc/api/permission-model.html.textile.liquid
@@ -15,9 +15,11 @@ Each API transaction (read, write, create, etc.) is done on behalf of a person.
 
 A user (person) is permitted to act on an object if there is a path (series of permission Links) from the acting user to the object in which
 
-* Every intervening object is a Group or a User, and
+* Every intervening object is a Group, and
 * Every intervening permission Link allows the current action
 
+Special case: A permission path can also include intervening User objects if the links _to_ the Users are "can_manage" links.
+
 Each object has exactly one _owner_, which can be either a User or a Group.
 
 * If the owner of X is A, then A is permitted to do any action on X.