diff --git a/xos/core/models/service.py b/xos/core/models/service.py
index fc9d454..2067a39 100644
--- a/xos/core/models/service.py
+++ b/xos/core/models/service.py
@@ -354,10 +354,10 @@
     def save(self, *args, **kwds):
         if not self.user.is_active:
             raise PermissionDenied, "Cannot modify role(s) of a disabled user"
-        super(SlicePrivilege, self).save(*args, **kwds)
+        super(TenantRootPrivilege, self).save(*args, **kwds)
 
     def can_update(self, user):
-        return user.tenant_root.can_update(user)
+        return user.can_update_tenant_root_privilege(self)
 
     @staticmethod
     def select_by_user(user):
diff --git a/xos/core/models/user.py b/xos/core/models/user.py
index 0098793..018e064 100644
--- a/xos/core/models/user.py
+++ b/xos/core/models/user.py
@@ -335,6 +335,9 @@
             return True
         return False
 
+    def can_update_tenant_root_privilege(self, tenant_root_privilege, allow=[]):
+        return self.can_update_tenant_root(tenant_root_privilege.tenant_root, allow)
+
     @staticmethod
     def select_by_user(user):
         if user.is_admin: