code: public void authorize(List<String> authHeader, String resource, Principal principal,
                            AuthHandler.Permissions permission) throws AuthException {
          if (!isAuthorized(authHeader, resource, principal, permission)) {
              throw new AuthorizationException(
                      String.format("Failed to authorize for resource [%s]", resource),
                      Response.Status.FORBIDDEN.getStatusCode());
          }
      }
docs: Ensures that the given {@code principal} has specified {@code permission} on the given {@code resource}.
  
  @param authHeader contents of an HTTP Authorization header
  @param resource   representation of the resource being accessed
  @param principal  the identity of the subject accessing the resource
  @param permission the permission
  @throws AuthException if authentication or authorization fails