@utilities.arguments_not_none<EOL><INDENT>def is_authorized(self, agent_id, function_id, qualifier_id):<DEDENT>
collection = JSONClientValidated('<STR_LIT>',<EOL>collection='<STR_LIT>',<EOL>runtime=self._runtime)<EOL>def is_parent_authorized(catalog_id):<EOL><INDENT>"""<STR_LIT>"""<EOL>parent_id_list = self._get_parent_id_list(catalog_id, hierarchy_id)<EOL>if parent_id_list:<EOL><INDENT>try:<EOL><INDENT>collection.find_one(<EOL>{'<STR_LIT>': str(agent_id),<EOL>'<STR_LIT>': str(function_id),<EOL>'<STR_LIT>': {'<STR_LIT>': parent_id_list}})<EOL><DEDENT>except errors.NotFound:<EOL><INDENT>for parent_id in parent_id_list:<EOL><INDENT>if is_parent_authorized(Id(parent_id)):<EOL><INDENT>return True<EOL><DEDENT><DEDENT>return False<EOL><DEDENT>else:<EOL><INDENT>return True<EOL><DEDENT><DEDENT>else:<EOL><INDENT>return False<EOL><DEDENT><DEDENT>try:<EOL><INDENT>authority = qualifier_id.get_identifier_namespace().split('<STR_LIT:.>')[<NUM_LIT:0>].upper()<EOL>identifier = qualifier_id.get_identifier_namespace().split('<STR_LIT:.>')[<NUM_LIT:1>].upper()<EOL><DEDENT>except KeyError:<EOL><INDENT>idstr_list = [str(qualifier_id)]<EOL>authority = identifier = None<EOL><DEDENT>else:<EOL><INDENT>package_name = qualifier_id.get_identifier_namespace().split('<STR_LIT:.>')[<NUM_LIT:0>]<EOL>qualifier_id = self._get_id(qualifier_id, package_name)<EOL>root_qualifier_id = Id(<EOL>authority=qualifier_id.get_authority(),<EOL>namespace=qualifier_id.get_identifier_namespace(),<EOL>identifier='<STR_LIT>')<EOL>idstr_list = [str(root_qualifier_id), str(qualifier_id)]<EOL><DEDENT>try:<EOL><INDENT>collection.find_one(<EOL>{'<STR_LIT>': str(agent_id),<EOL>'<STR_LIT>': str(function_id),<EOL>'<STR_LIT>': {'<STR_LIT>': idstr_list}})<EOL><DEDENT>except errors.NotFound:<EOL><INDENT>if authority and identifier:<EOL><INDENT>hierarchy_id = Id(authority=authority,<EOL>namespace='<STR_LIT>',<EOL>identifier=identifier)<EOL>return is_parent_authorized(qualifier_id)<EOL><DEDENT>else:<EOL><INDENT>return False<EOL><DEDENT><DEDENT>else:<EOL><INDENT>return True<EOL><DEDENT>
Determines if the given agent is authorized.

        An agent is authorized if an active authorization exists whose
        ``Agent,`` ``Function`` and ``Qualifier`` matches the supplied
        parameters. Authorizations may be defined using groupings or
        hieratchical structures for both the ``Agent`` and the
        ``Qualifier`` but are queried in the de-nornmalized form.

        The ``Agent`` is generally determined through the use of an
        Authentication OSID. The ``Function`` and ``Qualifier`` are
        already known as they map to the desired authorization to
        validate.

        arg:    agent_id (osid.id.Id): the ``Id`` of an ``Agent``
        arg:    function_id (osid.id.Id): the ``Id`` of a ``Function``
        arg:    qualifier_id (osid.id.Id): the ``Id`` of a ``Qualifier``
        return: (boolean) - ``true`` if the user is authorized,
                ``false`` othersise
        raise:  NotFound - ``function_id`` is not found
        raise:  NullArgument - ``agent_id`` , ``function_id`` or
                ``qualifier_id`` is ``null``
        raise:  OperationFailed - unable to complete request
        raise:  PermissionDenied - authorization failure making request
        *compliance: mandatory -- This method must be implemented.*
        *implementation notes*: Authorizations may be stored in a
        normalized form with respect to various Resources and created
        using specific nodes in a ``Function`` or ``Qualifer``
        hierarchy. The provider needs to maintain a de-normalized
        implicit authorization store or expand the applicable
        hierarchies on the fly to honor this query.  Querying the
        authorization service may in itself require a separate
        authorization. A ``PermissionDenied`` is a result of this
        authorization failure. If no explicit or implicit authorization
        exists for the queried tuple, this method should return
        ``false``.