I've got the edgiest of edge cases, but maybe we should handle it? I think we should probably move lines 169-171 to before 166, so the xacml policy gets added, effectively locking everyone else out of the object, before we add the relationships. The timing would be crazy, but in theory, if you had two people trying to acquire the lock at the same time (user a, and user b) then you could have this happen: 

1) User a writes relationship
2) User b writes another relationship 
3) User a writes the policy

Then we have an object in an inconsistent state.