allow user flows when the acting user is legitimate, but not its owner

for instance, when a sharee changes a file, the owner can act upon

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>