code: def allow_role(role):
      
      def processor(action, argument):
          db.session.add(
              ActionRoles.allow(action, argument=argument, role_id=role.id)
          )
      return processor
docs: Allow a role identified by an email address.