If the JiraAuthenticationContext is null (as it is for services) the IssueService validateUpdate fails on the assignee permission check, despite the api being given a user.

public UpdateValidationResult validateUpdate(ApplicationUser user, Long issueId, IssueInputParameters issueInputParameters)

When a NULL JAC context is present, when updating an issue, with no ASSIGNEE property present, the errors variable in the above method contain:

Errors: {}
Error Messages: [You do not have permission to assign issues.]

If the 'user' above is set as the JiraAuthenticationContext user, then no such error occurs.

During validateAndUpdateIssueFromFields() >

public void validateParams(OperationContext operationContext, ErrorCollection errorCollectionToAddTo, I18nHelper i18n, Issue issue, FieldScreenRenderLayoutItem fieldScreenRenderLayoutItem)

This method doesn't get the 'user' that was supplied through the issueservice validate method, which is a bug, the validateParams() method has:

            // The user must have 'assign' permission - as otherwise 'automatic' should be chosen, or the field should not
            // be presented at all
            if (!hasPermission(issue, Permissions.ASSIGN_ISSUE))
            {
                errorCollectionToAddTo.addErrorMessage(i18n.getText("assign.error.no.permission"), Reason.FORBIDDEN);
                return;
            }

which leads to:

permissionManager.hasPermission(permissionId, issue, getAuthenticationContext().getUser());

Therefore services need to hack the JiraAuthenticationContext user to be the same user being supplied through the issueservice API in order to stop validation errors, which should not be the case, it should use the user supplied through the issueservice validate method.