code: public boolean authorize(AuthenticationResult authResult, String appName, String uriName, Subject previousCaller, List<String> requiredRoles) {
          // Set the authorized subject on the thread
          subjectManager.setCallerSubject(authResult.getSubject());
          boolean isAuthorized = authorize(authResult, appName, uriName, requiredRoles);
          if (isAuthorized) {
              // at this point set invocation subject = caller subject.
              // delegation may change the invocation subject later
              subjectManager.setInvocationSubject(authResult.getSubject());
          } else {
              subjectManager.setCallerSubject(previousCaller);
          }
          return isAuthorized;
      }
docs: Call the authorization service to determine if the subject is authorized to the given roles
  
  @param authResult the authentication result, containing the subject, user name and realm
  @param appName the name of the application, used to look up the correct authorization table
  @param uriName the uri being accessed
  @param previousCaller the previous caller, used to restore the previous state if authorization fails
  @param requiredRoles the roles required to access the resource
  @return true if the subject is authorized, otherwise false