code: private AuthOutcome secureLevelControlApplications(Account operatedAccount, String applicationAccountSid,
              UserIdentityContext userIdentityContext) {
          /*
          // disabled strict policy that prevented access to sub-account applications
  
          // operatingAccount and operatedAccount are not null at this point
          Account operatingAccount = userIdentityContext.getEffectiveAccount();
          String operatingAccountSid = operatingAccount.getSid().toString();
          String operatedAccountSid = operatedAccount.getSid().toString();
          if (!operatingAccountSid.equals(String.valueOf(operatedAccountSid))) {
              return AuthOutcome.FAILED;
          } else if (applicationAccountSid != null && !operatingAccountSid.equals(applicationAccountSid)) {
              return AuthOutcome.FAILED;
          }
          return AuthOutcome.OK;
          */
  
          // use the more liberal default policy that applies to other entities for applications too
          return secureLevelControl(operatedAccount, applicationAccountSid, userIdentityContext);
      }
docs: Uses the security policy applied by secureLevelControl(). See there for details.
  
  DEPRECATED security policy:
  
  Applies the following access control rules
  
  If an application Account Sid is given:
  - If operatingAccount is the same as the operated account and application resource belongs to operated account too
  acces is granted.
  If no application Account Sid is given:
  - If operatingAccount is the same as the operated account access is granted.
  
  NOTE: Parent/ancestor relationships on accounts do not grant access here.
  
  @param operatedAccount
  @param applicationAccountSid
  @return