If a person has read  only permissions  to a document  then they can not modify
permissions.
You need at least modify permissions to make permission changes.

You would need to create a custom permission level called read  w/manage
Permissions. That permission level should be a copy of the read permission
level with one additional permission (manage permissions  from the Site
Permissions section). You would then apply this custom permission level to the
users in the list where you want them to modify permissions of documents. The
only issue would be that they would also be able to change  their own permissions
to the document  library or below to anything they want after you make the
change.

If what you are trying to do is give them the ability to change who can read a
document, but still limit them to read then it can't be done. Giving them the
right to change the permissions for others will give them the right to change
their own permissions.

It's even a little worse. Giving users the right to change
permissions at all means giving them the right to give
_the_right_to_change_permissions to anyone, whether or not they have been
trained in, or understand, or agree with your approach to authorization.

It would be nice if someday SharePoint would disaggregate "Manage
Permissions" and "Manage the Management of Permissions", so that people
could (e.g.) be given the right to add members to a site without the right
to add owners to the site.

It is possible to create a custom permission level that contains the Manage
Permissions permission. Be aware that would give that person the ability to
elevate their access beyond what you have given them however.

That's a good solution and I never thought of it.

Having a closer look to the Permission Level configuration, I see that
the "Manage Permissions" is on the "Site" level, not at
"List" level. Does this mean that if I give someone the
"manage permissions" inside a "List", that person will
have the ability of changing  user permissions  inside the whole site?



Better, I am talking about a list with document  specific access, i.e.
each person can only see a set of documents inside the list. I would
like that each of them could give access to someone different, if they
think that makes sense. The ideal situation would be, of course, just to
give read  access and not being able to change  their one access.

I have to think about the risk of having someone to change its access to
"full control" and then delete the document itself.

But, what I cannot have is people changing the site level permissions.
Will that be the case ?

Even though its a site permission it will only be able to manage permissions  in
a specific list if applied at the list level. But it sounds like you have broken
inheritance at the individual document  level. If so, then giving people manage
permissions at the list level won't necessarily allow them to change  permissions
on individual documents.

But it sounds like you have broken inheritance at the individual document
level. If so, then giving people manage permissions  at the list level won't
necessarily allow them to change  permissions on individual documents.
>

That I know: I will only give the "new" access to future documents (this are
mailing letters that are digitalized at HR everyday).

Thanks for your help, I will try this and let you know.