docs: def CheckAccess(self, subject, token):
      """Checks for access to given subject with a given token.
  
      CheckAccess runs given subject through all "allow" clauses that
      were previously registered with Allow() calls. It returns True on
      first match and raises access_control.UnauthorizedAccess if there
      are no matches or if any of the additional checks fails.
  
      Args:
        subject: RDFURN of the subject that will be checked for access.
        token: User credentials token.
  
      Returns:
        True if access is granted.
  
      Raises:
        access_control.UnauthorizedAccess if access is rejected.
      """
      subject = rdfvalue.RDFURN(subject)
      subject_str = subject.SerializeToString()
  
      for check_tuple in self.checks:
        regex_text, regex, require, require_args, require_kwargs = check_tuple
  
        match = regex.match(subject_str)
        if not match:
          continue
  
        if require:
          # If require() fails, it raises access_control.UnauthorizedAccess.
          require(subject, token, *require_args, **require_kwargs)
  
        logging.debug(
            u"Datastore access granted to %s on %s by pattern: %s "
            u"with reason: %s (require=%s, require_args=%s, "
            u"require_kwargs=%s, helper_name=%s)",
            utils.SmartUnicode(token.username), utils.SmartUnicode(subject_str),
            utils.SmartUnicode(regex_text), utils.SmartUnicode(token.reason),
            require, require_args, require_kwargs, self.helper_name)
        return True
  
      logging.warning("Datastore access denied to %s (no matched rules)",
                      subject_str)
      raise access_control.UnauthorizedAccess(
          "Access to %s rejected: (no matched rules)." % subject, subject=subject)