code: private AuthOutcome secureLevelControl(Account operatedAccount, String resourceAccountSid,
              UserIdentityContext userIdentityContext) {
          Account operatingAccount = userIdentityContext.getEffectiveAccount();
          String operatingAccountSid = null;
          if (operatingAccount != null)
              operatingAccountSid = operatingAccount.getSid().toString();
          String operatedAccountSid = null;
          if (operatedAccount != null)
              operatedAccountSid = operatedAccount.getSid().toString();
          // in case we're dealing with resources, we first make sure that they are accessed under their owner account.
          if (resourceAccountSid != null)
              if (! resourceAccountSid.equals(operatedAccountSid))
                  return AuthOutcome.FAILED;
          // check parent/ancestor relationship between operatingAccount and operatedAccount
          if ( operatingAccountSid.equals(operatedAccountSid) )
              return AuthOutcome.OK;
          if ( operatedAccount.getParentSid() != null ) {
              if (operatedAccount.getParentSid().toString().equals(operatingAccountSid))
                  return AuthOutcome.OK;
              else if (accountsDao.getAccountLineage(operatedAccount).contains(operatingAccountSid))
                  return AuthOutcome.OK;
          }
          return AuthOutcome.FAILED;
      }
docs: Applies the following access control rule:
  
  If no sub-resources are involved (resourceAccountSid is null):
  - If operatingAccount is the same or an ancestor of operatedAccount, access is granted
  If there are sub-resources involved:
  - If operatingAccount is the same or an ancestor of operatedAccount AND resource belongs to operatedAccount access is granted
  
  @param operatedAccount the account specified in the URL
  @param resourceAccountSid the account SID property of the operated resource e.g. the accountSid of a DID.