'Callback to validate RBAC_POLICY changes.
This is the dispatching function for create, update and delete
callbacks. On creation and update, verify that the creator is an admin
or owns the resource being shared.'

@classmethod
def validate_rbac_policy_change(cls, resource, event, trigger, context, object_type, policy, **kwargs):

    if (object_type != cls.rbac_db_model.object_type):
        return
    db_obj = obj_db_api.get_object(context.elevated(), cls.db_model, id=policy['object_id'])
    if (event in (events.BEFORE_CREATE, events.BEFORE_UPDATE)):
        if ((not context.is_admin) and (db_obj['tenant_id'] != context.tenant_id)):
            msg = _('Only    admins    can    manipulate    policies    on    objects    they    do    not    own')
            raise lib_exc.InvalidInput(error_message=msg)
    callback_map = {events.BEFORE_UPDATE: cls.validate_rbac_policy_update, events.BEFORE_DELETE: cls.validate_rbac_policy_delete}
    if (event in callback_map):
        return callback_map[event](resource, event, trigger, context, object_type, policy, **kwargs)
