def METHOD_NAME(self, path, section, rtype, sdata, user_grants, obj, orig_obj, all_ns, thr=None):
    errors = []
    for key, val in sdata.items():
        if "trigger" in key or key.startswith("pre_") or key.startswith("post_") or key.startswith("blocking_"):
            errors.append("%s: keyword %s.%s=%s requires the root role" % (path, section, key, val))
            continue
        _key = key.split("@")[0]
        try:
            _val = obj.oget(section, _key)
        except Exception as exc:
            errors.append("%s: %s" % (path, exc))
            continue
        # scopable
        for n in obj.nodes | obj.drpnodes:
            _val = obj.oget(section, _key, impersonate=n)
            if _key in ("container_data_dir") and _val:
                if _val.startswith("/"):
                    errors.append("%s: keyword %s.%s=%s host paths require the root role" % (path, section, key, _val))
                    continue
            if _key in ("devices", "volume_mounts") and _val:
                _errors = []
                for __val in _val:
                    if __val.startswith("/"):
                        if __val.split(":")[0] in ALLOWED_HOST_PATHS:
                            continue
                        _errors.append("%s: keyword %s.%s=%s host paths require the root role" % (path, section, key, __val))
                        continue
                if _errors:
                    errors += _errors
                    break
            if section == "DEFAULT" and _key == "monitor_action" and _val not in ("freezestop", "switch", None):
                errors.append("%s: keyword %s.%s=%s requires the root role" % (path, section, key, _val))
                break
            if section.startswith("container#") and _key == "netns" and _val == "host":
                errors.append("%s: keyword %s.%s=%s requires the root role" % (path, section, key, _val))
                break
            if section.startswith("container#") and _key == "privileged" and _val not in ("false", False, None):
                errors.append("%s: keyword %s.%s=%s requires the root role" % (path, section, key, _val))
                break
            if section.startswith("ip#") and _key == "netns" and _val in (None, "host"):
                errors.append("%s: keyword %s.%s=%s requires the root role" % (path, section, key, _val))
                break
        # unscopable
        if section == "DEFAULT" and _key == "cn":
            errors += self.rbac_kw_cn(path, _val, orig_obj)
        elif section == "DEFAULT" and _key == "grant":
            errors += self.rbac_kw_grant(path, _val, user_grants, all_ns, thr=thr)
    return errors