code: private AuthOutcome secureLevelControlAccounts(Account operatedAccount,
              UserIdentityContext userIdentityContext) throws AccountHierarchyDepthCrossed {
          // operatingAccount and operatedAccount are not null
          Account operatingAccount = userIdentityContext.getEffectiveAccount();
          String operatingAccountSid = operatingAccount.getSid().toString();
          String operatedAccountSid = operatedAccount.getSid().toString();
          if (getAdministratorRole().equals(operatingAccount.getRole())) {
              // administrator can also operate on themselves, direct children, grand-children
              if (operatingAccountSid.equals(operatedAccountSid))
                  return AuthOutcome.OK;
              if (operatedAccount.getParentSid() != null ) {
                  if (operatedAccount.getParentSid().toString().equals(operatingAccountSid ))
                      return AuthOutcome.OK;
                  else if (accountsDao.getAccountLineage(operatedAccount).contains(operatingAccountSid))
                      return AuthOutcome.OK;
              }
              return AuthOutcome.FAILED;
          } else { // non-administrators can only operate directly on themselves
              if ( operatingAccountSid.equals(operatedAccountSid) )
                  return AuthOutcome.OK;
              else
                  return AuthOutcome.FAILED;
          }
      }
docs: Applies the following access control rules:
  
  If the operating account is an administrator:
  - If it is the same or parent/ancestor of the operated account access is granted.
  If the operating accoutn is NOT an administrator:
  - If it is the same as the operated account access is granted.
  
  @param operatedAccount
  @return