def is_allowed(self, role, operation, resource, check_allowed=True, **assertion_kwargs):
        assert not role or role in self._roles
        assert not resource or resource in self._resources

        roles = set(get_family(self._roles, role))
        operations = {None, operation}
        resources = set(get_family(self._resources, resource))

        is_allowed = None
        default_assertion = lambda *args, **kwargs: True

        for permission in itertools.product(roles, operations, resources):
            if permission in self._denied:
                assertion = self._denied[permission] or default_assertion
                if assertion(self, role, operation, resource, **assertion_kwargs):
                    return False  # denied by rule immediately

            if check_allowed and permission in self._allowed:
                assertion = self._allowed[permission] or default_assertion
                if assertion(self, role, operation, resource, **assertion_kwargs):
                    is_allowed = True  # allowed by rule

        return is_allowed
Check the permission.
dataset/ETHPy150Open tonyseek/simple-rbac/rbac/acl.py/Registry.is_allowed