I'm surprised to see this here. It seems like a strange expansion of responsibilities for the class representing the Role to also manage the permissions about who has permissions to modify the Role. I would have expected this check of the caller to happen at the point where `add_users` and `remove_users` are called.