code: private Result<NsDAO.Data> mayUserVirtueOfNS(AuthzTrans trans, String user,	NsDAO.Data nsd, String ns_and_type, String access) {
  		String ns = nsd.name;
  
  		// If an ADMIN of the Namespace, then allow
  		
  		Result<List<UserRoleDAO.Data>> rurd;
  		if ((rurd = userRoleDAO.readUserInRole(trans, user, nsd.name+ADMIN)).isOKhasData()) {
  			return Result.ok(nsd);
  		} else if(rurd.status==Result.ERR_Backend) {
  			return Result.err(rurd);
  		}
  		
  		// If Specially granted Global Permission
  		if (isGranted(trans, user, Define.ROOT_NS,NS, ns_and_type, access)) {
  			return Result.ok(nsd);
  		}
  
  		// Check recur
  
  		int dot = ns.length();
  		if ((dot = ns.lastIndexOf('.', dot - 1)) >= 0) {
  			Result<NsDAO.Data> rnsd = deriveNs(trans, ns.substring(0, dot));
  			if (rnsd.isOK()) {
  				rnsd = mayUserVirtueOfNS(trans, user, rnsd.value, ns_and_type,access);
  			} else if(rnsd.status==Result.ERR_Backend) {
  				return Result.err(rnsd);
  			}
  			if (rnsd.isOK()) {
  				return Result.ok(nsd);
  			} else if(rnsd.status==Result.ERR_Backend) {
  				return Result.err(rnsd);
  			}
  		}
  		return Result.err(Status.ERR_Denied, "%s may not %s %s", user, access,
  				ns_and_type);
  	}
docs: /*
  Check (recursively, if necessary), if able to do something based on NS