Here's what I came up with - this code checks to see if the current user has really granted privilege to the current record:
var principalAccessRequest = new RetrievePrincipalAccessRequest
{
Principal = new EntityReference("systemuser", localContext.PluginExecutionContext.UserId),
Target = new EntityReference(localContext.PluginExecutionContext.PrimaryEntityName, localContext.PluginExecutionContext.PrimaryEntityId)
};
var principalAccessResponse = (RetrievePrincipalAccessResponse)localContext.OrganizationService.Execute(principalAccessRequest);
if ((principalAccessResponse.AccessRights & AccessRights.WriteAccess) != AccessRights.None)
{
...
...
...
}
if , WriteAccess .