if err != nil {
			return updatedAt, addedOrRemoved, effectivePolicies, err
		}
	} else {
		var isTemp bool
		isTemp, _, err = sys.IsTempUser(userOrGroup)
		if err != nil && err != errNoSuchUser {
			return updatedAt, addedOrRemoved, effectivePolicies, err
		}
		if isTemp {
			err = errIAMActionNotAllowed
			return updatedAt, addedOrRemoved, effectivePolicies, err
		}

	userType IAMUserType, policies []string, isAttach bool) (updatedAt time.Time,
	addedOrRemoved, effectivePolicies []string, err error,
) {
	if name == "" {
		err = errInvalidArgument
		return updatedAt, addedOrRemoved, effectivePolicies, err
	}

	cache := store.lock()
	defer store.unlock()

	// Load existing policy mapping
	var mp MappedPolicy