Function check 

pub fn check(
    session: Option<&dyn LysSession>,
    action: HotAction,
    value: &str,
) -> Result<(), AgentError>

Identity is an additional fence; passing it grants no subject right.

Errors

A foreign identity claim or a write to server-owned metadata.