docs: def _access_policy_pyxb_to_model(sci_model, sysmeta_pyxb):
      """Create or update the database representation of the sysmeta_pyxb access policy.
  
      If called without an access policy, any existing permissions on the object
      are removed and the access policy for the rights holder is recreated.
  
      Preconditions:
        - Each subject has been verified to a valid DataONE account.
        - Subject has changePermission for object.
  
      Postconditions:
        - The Permission and related tables contain the new access policy.
  
      Notes:
        - There can be multiple rules in a policy and each rule can contain multiple
          subjects. So there are two ways that the same subject can be specified multiple
          times in a policy. If this happens, multiple, conflicting action levels may be
          provided for the subject. This is handled by checking for an existing row for
          the subject for this object and updating it if it contains a lower action
          level. The end result is that there is one row for each subject, for each
          object and this row contains the highest action level.
  
      """
      _delete_existing_access_policy(sysmeta_pyxb)
      # Add an implicit allow rule with all permissions for the rights holder.
      allow_rights_holder = d1_common.types.dataoneTypes.AccessRule()
      permission = d1_common.types.dataoneTypes.Permission(
          d1_gmn.app.auth.CHANGEPERMISSION_STR
      )
      allow_rights_holder.permission.append(permission)
      allow_rights_holder.subject.append(
          d1_common.xml.get_req_val(sysmeta_pyxb.rightsHolder)
      )
      top_level = _get_highest_level_action_for_rule(allow_rights_holder)
      _insert_permission_rows(sci_model, allow_rights_holder, top_level)
      # Create db entries for all subjects for which permissions have been granted.
      if _has_access_policy_pyxb(sysmeta_pyxb):
          for allow_rule in sysmeta_pyxb.accessPolicy.allow:
              top_level = _get_highest_level_action_for_rule(allow_rule)
              _insert_permission_rows(sci_model, allow_rule, top_level)