docs: def is_allowed(request, level, pid):
      """Check if one or more subjects are allowed to perform action level on object.
  
      If a subject holds permissions for one action level on object, all lower action
      levels are also allowed. Any included subject that is unknown to this MN is treated
      as a subject without permissions.
  
      Returns:
        bool
          True:
            - The active subjects include one or more subjects that:
            - are fully trusted DataONE infrastructure subjects, causing all rights to be
              granted regardless of requested access level and SciObj
            - OR are in the object's ACL for the requested access level. The ACL contains
              the subjects from the object's allow rules and the object's rightsHolder,
              which has all rights.
            - OR object is public, which always yields a match on the "public" symbolic
              subject.
            False:
            - None of the active subjects are in the object's ACL for the requested
              access level or for lower levels.
            - OR PID does not exist
            - OR access level is invalid
  
      """
      if is_trusted_subject(request):
          return True
      return d1_gmn.app.models.Permission.objects.filter(
          sciobj__pid__did=pid,
          subject__subject__in=request.all_subjects_set,
          level__gte=level,
      ).exists()