code: def _check_operations(ctx, need_ops, arg):
      ''' Checks an allow or a deny caveat. The need_ops parameter specifies
      whether we require all the operations in the caveat to be declared in
      the context.
      '''
      ctx_ops = ctx.get(OP_KEY, [])
      if len(ctx_ops) == 0:
          if need_ops:
              f = arg.split()
              if len(f) == 0:
                  return 'no operations allowed'
              return '{} not allowed'.format(f[0])
          return None
  
      fields = arg.split()
      for op in ctx_ops:
          err = _check_op(op, need_ops, fields)
          if err is not None:
              return err
      return Nonf _check_operations(ctx, need_ops, arg):
      ''' Checks an allow or a deny caveat. The need_ops parameter specifies
      whether we require all the operations in the caveat to be declared in
      the context.
      '''
      ctx_ops = ctx.get(OP_KEY, [])
      if len(ctx_ops) == 0:
          if need_ops:
              f = arg.split()
              if len(f) == 0:
                  return 'no operations allowed'
              return '{} not allowed'.format(f[0])
          return None
  
      fields = arg.split()
      for op in ctx_ops:
          err = _check_op(op, need_ops, fields)
          if err is not None:
              return err
      return None
docs: Checks an allow or a deny caveat. The need_ops parameter specifies
      whether we require all the operations in the caveat to be declared in
      the context.