Meta security
Security assignment is itself subject to security constraints.
In order to change the access privileges to a group and an object, you must have ADMIN privileges to both. If you are a member of the ADMIN or SecurityAdmin group, you are free to do any assignment of rights. However, the assignment of security rights can be delegated to any portion of the data in a server by appropriately granting ADMIN privileges to specific objects.