Alternatively he could use a Windows security group - if he is the only member of that group granting permissions to the group would effectively grant it to himself.