title: Different update permissions of same resource in REST API
body: <p>Assume I have a simple "employee" resource in a REST API:</p>
  
  <pre><code>{
      "employee_id": "1234ABCD",
      "name": "John Doe",
      "title": "Developer",
      "salary": 50000
  }
  </code></pre>
  
  <p>Both employee and manager have permission to read the entire resource. The manager has permission to update all of the resource's properties, but the employee only has permission to update the <code>name</code> property.</p>
  
  <p>The API supports partial updates of the resource through PATCH or POST or whatever (not important to the question). If the employee attempts to update <code>salary</code> (which he does not have permission to do), what would the appropriate response be? I see a few options, and I'm not sure what the most reasonable approach is:</p>
  
  <ul>
  <li><p>Ignore any fields in his update that he does not have permission to modify and return a 200 response. <em>This doesn't seem quite right because the API is saying "OK, I did it" when in fact it didn't update everything it was told to update.</em></p></li>
  <li><p>Respond with 403 Forbidden. <em>This doesn't seem quite right because the employee does have permission to modify the resource, just not the all of the fields he is attempting to modify.</em></p></li>
  <li><p>Respond with 400 Bad Request. <em>This doesn't seem quite right because the request actually wasn't bad, just "bad" for this user.</em></p></li>
  <li><p>Some other response I hadn't considered?</p></li>
  </ul>
  
  <p>What is the best response in a situation like this?</p>