What are the rules used by the system to determine whether a user is authorized to update an object?

The user should have the permission to update the object. This is given by the Definition security. The group which holds the object should be added to the permission list of the user in update mode.