Person removed from access policy on update

[laurenwalker]

Rani reported a package with OPC where someone was added as an 'owner' of the metadata record but not the resource map. I tried to remove this person and add them back and the access policy messed up again. Here is the access policy before I updated it:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ns3:systemMetadata xmlns:ns2="http://ns.dataone.org/service/types/v1" xmlns:ns3="http://ns.dataone.org/service/types/v2.0">
    <serialVersion>0</serialVersion>
    <identifier>resource_map_urn:uuid:d61c20ba-1441-4a10-90ec-1bb2275ecf2a</identifier>
    <formatId>http://www.openarchives.org/ore/terms</formatId>
    <size>5317</size>
    <checksum algorithm="MD5">fea2a859d9dfea3f2139f9a955094e98</checksum>
    <submitter>http://orcid.org/0000-0003-1501-0861</submitter>
    <rightsHolder>http://orcid.org/0000-0001-7205-2123</rightsHolder>
    <accessPolicy>
        <allow>
            <subject>http://orcid.org/0000-0002-0594-2166</subject>
            <permission>read</permission>
            <permission>write</permission>
            <permission>changePermission</permission>
        </allow>
        <allow>
            <subject>http://orcid.org/0000-0001-7205-2123</subject>
            <permission>read</permission>
            <permission>write</permission>
            <permission>changePermission</permission>
        </allow>
        <allow>
            <subject>CN=opc-data-admins,DC=dataone,DC=org</subject>
            <permission>read</permission>
            <permission>write</permission>
            <permission>changePermission</permission>
        </allow>
    </accessPolicy>
    <replicationPolicy replicationAllowed="false"/>
    <obsoletes>resource_map_urn:uuid:5303f61a-dcbf-47df-86a9-4b4ff3246396</obsoletes>
    <archived>false</archived>
    <dateUploaded>2021-11-15T21:12:31.056+00:00</dateUploaded>
    <dateSysMetadataModified>2021-11-15T21:12:31.237+00:00</dateSysMetadataModified>
    <originMemberNode>urn:node:CA_OPC</originMemberNode>
    <authoritativeMemberNode>urn:node:CA_OPC</authoritativeMemberNode>
    <fileName>resource_map_urn_uuid_d61c20ba_1441_4a10_90ec_1bb2275ecf2a.rdf.xml</fileName>
</ns3:systemMetadata>

Here is the sys meta after I removed and added back the ORCID ending in 6260:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ns3:systemMetadata xmlns:ns2="http://ns.dataone.org/service/types/v1" xmlns:ns3="http://ns.dataone.org/service/types/v2.0">
    <serialVersion>0</serialVersion>
    <identifier>resource_map_urn:uuid:d61c20ba-1441-4a10-90ec-1bb2275ecf2a</identifier>
    <formatId>http://www.openarchives.org/ore/terms</formatId>
    <size>5317</size>
    <checksum algorithm="MD5">fea2a859d9dfea3f2139f9a955094e98</checksum>
    <submitter>http://orcid.org/0000-0003-1501-0861</submitter>
    <rightsHolder>http://orcid.org/0000-0001-7205-2123</rightsHolder>
    <accessPolicy>
        <allow>
            <subject>http://orcid.org/0000-0001-7205-2123</subject>
            <permission>read</permission>
            <permission>write</permission>
            <permission>changePermission</permission>
        </allow>
        <allow>
            <subject>http://orcid.org/0000-0002-0594-2166</subject>
            <permission>read</permission>
            <permission>write</permission>
            <permission>changePermission</permission>
        </allow>
        <allow>
            <subject>http://orcid.org/0000-0001-9635-6260</subject>
            <permission>read</permission>
        </allow>
    </accessPolicy>
    <replicationPolicy replicationAllowed="false"/>
    <obsoletes>resource_map_urn:uuid:5303f61a-dcbf-47df-86a9-4b4ff3246396</obsoletes>
    <archived>false</archived>
    <dateUploaded>2021-11-15T21:12:31.056+00:00</dateUploaded>
    <dateSysMetadataModified>2021-11-15T21:51:36.156+00:00</dateSysMetadataModified>
    <originMemberNode>urn:node:CA_OPC</originMemberNode>
    <authoritativeMemberNode>urn:node:CA_OPC</authoritativeMemberNode>
    <fileName>resource_map_urn_uuid_d61c20ba_1441_4a10_90ec_1bb2275ecf2a.rdf.xml</fileName>
</ns3:systemMetadata>

Note that the OPC Data Admins group was removed completely, and the 6260 ORCID was added but only with read permission.