def METHOD_NAME(
    user2_api_client,
    payment_with_public_metadata,
    permission_manage_orders,
):
    # given
    assert not payment_owned_by_user(
        payment_with_public_metadata.pk, user2_api_client.user
    )
    # when
    response = execute_query_public_metadata_for_payment(
        user2_api_client,
        payment_with_public_metadata,
        permissions=[permission_manage_orders],
    )
    # then
    assert_no_permission(response)