code: func (a *gcPermissionsEnforcement) ownerRefToDeleteAttributeRecords(ref metav1.OwnerReference, attributes admission.Attributes) ([]authorizer.AttributesRecord, error) {
  	var ret []authorizer.AttributesRecord
  	groupVersion, err := schema.ParseGroupVersion(ref.APIVersion)
  	if err != nil {
  		return ret, err
  	}
  	mappings, err := a.restMapper.RESTMappings(schema.GroupKind{Group: groupVersion.Group, Kind: ref.Kind}, groupVersion.Version)
  	if err != nil {
  		return ret, err
  	}
  	for _, mapping := range mappings {
  		ar := authorizer.AttributesRecord{
  			User:            attributes.GetUserInfo(),
  			Verb:            "update",
  			APIGroup:        mapping.Resource.Group,
  			APIVersion:      mapping.Resource.Version,
  			Resource:        mapping.Resource.Resource,
  			Subresource:     "finalizers",
  			Name:            ref.Name,
  			ResourceRequest: true,
  			Path:            "",
  		}
  		if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
  			// if the owner is namespaced, it must be in the same namespace as the dependent is.
  			ar.Namespace = attributes.GetNamespace()
  		}
  		ret = append(ret, ar)
  	}
  	return ret, nil
  }
docs: // Translates ref to a DeleteAttribute deleting the object referred by the ref.
  // OwnerReference only records the object kind, which might map to multiple
  // resources, so multiple DeleteAttribute might be returned.