Access policies: How to allow update/delete entity only for it’s owner? - Manifest