All users have view permissions. Admin users, and users with
        org:admin can create, update, and delete any user. Any user can update
        or delete themselves. Only admins can create or modify other admin
        users.

def object_permission_set(self):
        '''All users have view permissions. Admin users, and users with
        org:admin can create, update, and delete any user. Any user can update
        or delete themselves. Only admins can create or modify other admin
        users.'''
        return Or(
            AllowOnlySafeHttpMethod,
            AllowAdmin,
            And(
                AllowPermission('org:admin'),
                ObjAttrTrue(lambda _, u: not u.is_superuser),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
            And(
                AllowModify,
                ObjAttrTrue(
                    lambda req, user: user == req.user),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
        )