Idiomatic RBAC recipe for handling ownership domain/tenancy without hardcoding values?

Is there an idiomatic RBAC recipe or example for handling an ownership domain/tenancy without hardcoding the values into the policy?
For example, one could imagine a resource like /{ownerid}/pets/{petid}. A role like role::admin may be able to access resources matching the glob /*/pets/** but a user like role::owner with owner ID 23 should only be able to access /23/pets/**.
If the service has thousands of customers with role::owner I'm sure the policy wouldn't contain a line for each ownerid as a value for dom like this example implies.
Perhaps this is something that lives outside the context & responsibility of the RBAC policy, is that the case? Or are there examples of how this type of policy would be implemented within the contexts of a casbin RBAC policy & model?
So far I've been playing with the idea of using the dom component in the policy as the glob pattern to use to keyGet3 the real value from r.dom and match it against the r.obj like:

keyGet3(r.dom, p.dom, "ownerid") == keyGet3(r.obj, "/{dom}/**", "dom")

This feels kinda hacky and against the spirit of a simple RBAC policy & model so I'm wondering if there is a better way that I haven't considered or found examples for yet.

try AI in the editor: https://editor.casbin.org/

I'm also interested in knowing how best to do this

The work I was doing regarding this got parked for a while so I haven't had any progress on a solution.

IIRC The solution we were heading towards was checking this outside of the policy by confirming, via data in the JWT or auth DB tables, that the subject has access to that particular Owner ID. Alternatively some sort of solution involving dynamic policies that are generated and saved for users/owners. But I can't say anything concretely yet unfortunately.