The following rules must apply for a user to be able to save a content object in ContentService methods

saveAndVersionLockedContentObject
saveLockedContentObject
saveContentObject
saveAndVersionContentObject

1. User has CmsRole.ROLE_ADMIN or is SYSTEM user (It is supposed that user SYSTEM has all roles)
2. ContentObject is new and user has role ROLE_CMS_EDITOR
3. ContentObject already exists in repository and user is the owner of the object
4. ContentObject already exists in repository, user is not the owner of the object but content object has accessibility.canBeUpdated
    whose value is ALL, or contains at least one of the roles user possesses, or explicitly contains user's id
5. Content type is roleObject (that is its qualified name is {http://www.betaconceptframework.org/schema/betacms/identity/role}roleObject) and identityStore repository is the same with the repository and user has role CmsRole.ROLE_CMS_IDENTITY_STORE_EDITOR