def METHOD_NAME(cls, user_or_token):
    aliased = safe_aliased(cls)
    user_id = UserAccessControl.user_id_from_user_or_token(user_or_token)
    user_allocation_admin = (
        DBSession()
        .query(Allocation)
        .join(GroupUser, GroupUser.group_id == Allocation.group_id)
        .filter(sa.and_(GroupUser.user_id == user_id, GroupUser.admin.is_(True)))
    )
    query = (
        DBSession().query(cls).join(aliased, cls.allocation_id == aliased.allocation_id)
    )
    if not user_or_token.is_system_admin:
        query = query.filter(
            sa.or_(
                aliased.user_id == user_id,
                sa.and_(aliased.admin.is_(True), aliased.user_id == user_id),
                aliased.allocation_id.in_(
                    [allocation.id for allocation in user_allocation_admin.all()]
                ),
            )
        )
    return query