Users are limited in their ability to change access permissions, which are set by administrators or policy-makers.