code: public boolean isAllowedTo(String subjectid, String resourcePath, String httpMethod) {
  		boolean allow = false;
  		if (subjectid != null && !StringUtils.isBlank(resourcePath) && !StringUtils.isBlank(httpMethod)) {
  			// urlDecode resource path
  			resourcePath = Utils.urlDecode(resourcePath);
  
  			if (getResourcePermissions().isEmpty()) {
  				// Default policy is "deny all". Returning true here would make it "allow all".
  				return false;
  			}
  			if (isDeniedExplicitly(subjectid, resourcePath, httpMethod)) {
  				return false;
  			}
  			if (getResourcePermissions().containsKey(subjectid) &&
  					getResourcePermissions().get(subjectid).containsKey(resourcePath)) {
  				// subject-specific permissions have precedence over wildcard permissions
  				// i.e. only the permissions for that subjectid are checked, other permissions are ignored
  				allow = isAllowed(subjectid, resourcePath, httpMethod);
  			} else {
  				allow = isAllowed(subjectid, resourcePath, httpMethod) ||
  						isAllowed(subjectid, ALLOW_ALL, httpMethod) ||
  						isAllowed(ALLOW_ALL, resourcePath, httpMethod) ||
  						isAllowed(ALLOW_ALL, ALLOW_ALL, httpMethod);
  			}
  		}
  		if (allow) {
  			if (isRootApp() && !Config.getConfigBoolean("clients_can_access_root_app", false)) {
  				return false;
  			}
  			if (StringUtils.isBlank(subjectid)) {
  				// guest access check
  				return isAllowed(ALLOW_ALL, resourcePath, GUEST.toString());
  			}
  			return true;
  		}
  		return isAllowedImplicitly(subjectid, resourcePath, httpMethod);
  	}
docs: Checks if a subject is allowed to call method X on resource Y.
  @param subjectid subject id
  @param resourcePath resource path or object type
  @param httpMethod HTTP method name
  @return true if allowed