title: Grails w/ Spring Security Core only allowing owner to update in GSP
body: <p><a href="https://stackoverflow.com/questions/3143354/grails-access-only-for-objects-owner">This question</a> has some code to add to the controller closure, which is fine, but what if I want to use the grails default scaffolding views but only have the edit/update buttons appear if the user is a manager, or the domain object is owned by the user? <a href="http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/index.html" rel="nofollow noreferrer">Reading the documentation</a>, I've tried:</p>
  
  <pre><code>&lt;sec:access expression="hasRole('ROLE_MANAGER') || (projectInstance.owner == springSecurityService.currentUser)"&gt;
     &lt;span class="button"&gt;&lt;g:actionSubmit class="save" action="update" value="${message(code: 'default.button.update.label', default: 'Update')}" /&gt;&lt;/span&gt;
  &lt;/sec:access&gt;
  </code></pre>
  
  <p>But the access class doesn't seem to allow ORs:</p>
  
  <pre><code>Error processing GroovyPageView: Error executing tag &lt;g:form&gt;: Error executing tag &lt;sec:access&gt;: Cannot handle (124) '|' 
  </code></pre>
  
  <p>Anyone done something similar?</p>