Comment 6 for bug 1475422

@Liyingjun
So the real issue here is the elevated context on the get; the policy should just allow Tenants to get their volumes (or not); we need to fix up the db calls here.

I have an idea on how to address this and get it fixed up, let me know if you're still planning to work on this and need any help; otherwise feel free to assign it to me and i'll fix it up.