* change from access_attributes to owner on dynamically created resources * define simpler string based conditions for more intuitive restriction