Checks an allow or a deny caveat. The need_ops parameter specifies
    whether we require all the operations in the caveat to be declared in
    the context.

def _check_operations(ctx, need_ops, arg):
    ''' Checks an allow or a deny caveat. The need_ops parameter specifies
    whether we require all the operations in the caveat to be declared in
    the context.
    '''
    ctx_ops = ctx.get(OP_KEY, [])
    if len(ctx_ops) == 0:
        if need_ops:
            f = arg.split()
            if len(f) == 0:
                return 'no operations allowed'
            return '{} not allowed'.format(f[0])
        return None

    fields = arg.split()
    for op in ctx_ops:
        err = _check_op(op, need_ops, fields)
        if err is not None:
            return err
    return None