Custom Security: Ownership in Personal Stream

[kleedom]

I have been attempting (and failing) to create a Security Rule so that my app builders can have full control over the apps that exist in their personal stream. I'm thinking that at this point, I should just have the app owner changed when it is duplicated into their stream, but I am not sure how to get started. 

The problem the users are facing is that when they duplicate an app, they do not have access to modify the Data Manager or Data Load Editor.

Any ideas on how this could be accomplished?

[kleedom · Accepted solution]

It looks like I have answered my own question.

Give Update permission on App.Object_* with a condition of 

user.group=<AD User Group> and resource.App.stream.Empty() and resource.app.owner = user.name