var oldDN string
		if isGroup {
			oldDN = r.Group
		} else {
			oldDN = r.User
		}
		if oldDN != dn {
			sys.store.PolicyDBUpdate(ctx, oldDN, isGroup, stsUser, r.Policies, isAttach)
		}
	}

	userType := stsUser
	updatedAt, addedOrRemoved, effectivePolicies, err = sys.store.PolicyDBUpdate(
		ctx, dn, isGroup, userType, r.Policies, isAttach)
	if err != nil {
		return
	}