docs: def CheckAccess(self, token):
      """Enforce a dual approver policy for access."""
      namespace, _ = self.urn.Split(2)
  
      if namespace != "ACL":
        raise access_control.UnauthorizedAccess(
            "Approval object has invalid urn %s." % self.urn,
            subject=self.urn,
            requested_access=token.requested_access)
  
      user, subject_urn = self.InferUserAndSubjectFromUrn()
      if user != token.username:
        raise access_control.UnauthorizedAccess(
            "Approval object is not for user %s." % token.username,
            subject=self.urn,
            requested_access=token.requested_access)
  
      now = rdfvalue.RDFDatetime.Now()
  
      # Is this an emergency access?
      break_glass = self.Get(self.Schema.BREAK_GLASS)
      if break_glass and now < break_glass:
        # This tags the token as an emergency token.
        token.is_emergency = True
        return True
  
      # Check that there are enough approvers.
      approvers = self.GetNonExpiredApprovers()
      approvers_required = config.CONFIG["ACL.approvers_required"]
      if len(approvers) < approvers_required:
        missing = approvers_required - len(approvers)
        msg = ("Need at least %d additional approver%s for access." %
               (missing, "s" if missing > 1 else ""))
  
        raise access_control.UnauthorizedAccess(
            msg, subject=subject_urn, requested_access=token.requested_access)
  
      # Check User labels
      if self.checked_approvers_label:
        approvers_with_label = []
  
        # We need to check labels with high privilege since normal users can
        # inspect other user's labels.
        for approver in approvers:
          try:
            user = aff4.FACTORY.Open(
                "aff4:/users/%s" % approver,
                aff4_type=aff4_users.GRRUser,
                token=token.SetUID())
            if self.checked_approvers_label in user.GetLabelsNames():
              approvers_with_label.append(approver)
          except IOError:
            pass
  
        if len(approvers_with_label) < self.min_approvers_with_label:
          missing = self.min_approvers_with_label - len(approvers_with_label)
          raise access_control.UnauthorizedAccess(
              "Need at least 1 admin approver for access.",
              subject=subject_urn,
              requested_access=token.requested_access)
  
      return True