def _validate_decrypt_query_parameter(decrypt, scope, is_admin, user_db):
    """
    Validate that the provider user is either admin or requesting to decrypt value for
    themselves.
    """
    is_user_scope = scope == USER_SCOPE or scope == FULL_USER_SCOPE
    if decrypt and (not is_user_scope and not is_admin):
        msg = "Decrypt option requires administrator access"
        raise AccessDeniedError(message=msg, user_db=user_db)

    Validate that the provider user is either admin or requesting to decrypt value for
    themselves.
    
st2common/st2common/util/keyvalue.py