code: protected function _isAllowedRole($userRoles, array $allowedRoles) {
  		if (in_array('*', $allowedRoles)) {
  			return true;
  		}
  		if (is_string($userRoles)) {
  			$userRoles = [$userRoles];
  		}
  		foreach ($userRoles as $userRole) {
  			if (in_array($userRole, $allowedRoles)) {
  				return true;
  			}
  		}
  		return false;
  	}
docs: Checks if a role is allowed.
  
  @param array|string $userRoles
  @param array $allowedRoles
  @return boolean