public AuthResult permissionGranted(String request, User user, Action permRequest,
    TableName tableName, Map<byte[], ? extends Collection<?>> families) {
    // 1. All users need read access to hbase:meta table.
    // this is a very common operation, so deal with it quickly.
    if (TableName.META_TABLE_NAME.equals(tableName)) {
      if (permRequest == Action.READ) {
        return AuthResult.allow(request, "All users allowed", user, permRequest, tableName,
          families);
      }
    }

    if (user == null) {
      return AuthResult.deny(request, "No user associated with request!", null, permRequest,
        tableName, families);
    }

    // 2. check for the table-level, if successful we can short-circuit
    if (getAuthManager().authorizeUserTable(user, tableName, permRequest)) {
      return AuthResult.allow(request, "Table permission granted", user, permRequest, tableName,
        families);
    }

    // 3. check permissions against the requested families
    if (families != null && families.size() > 0) {
      // all families must pass
      for (Map.Entry<byte[], ? extends Collection<?>> family : families.entrySet()) {
        // a) check for family level access
        if (getAuthManager().authorizeUserTable(user, tableName, family.getKey(), permRequest)) {
          continue; // family-level permission overrides per-qualifier
        }

        // b) qualifier level access can still succeed
        if ((family.getValue() != null) && (family.getValue().size() > 0)) {
          if (family.getValue() instanceof Set) {
            // for each qualifier of the family
            Set<byte[]> familySet = (Set<byte[]>) family.getValue();
            for (byte[] qualifier : familySet) {
              if (
                !getAuthManager().authorizeUserTable(user, tableName, family.getKey(), qualifier,
                  permRequest)
              ) {
                return AuthResult.deny(request, "Failed qualifier check", user, permRequest,
                  tableName, makeFamilyMap(family.getKey(), qualifier));
              }
            }
          } else if (family.getValue() instanceof List) { // List<Cell>
            List<Cell> cellList = (List<Cell>) family.getValue();
            for (Cell cell : cellList) {
              if (
                !getAuthManager().authorizeUserTable(user, tableName, family.getKey(),
                  CellUtil.cloneQualifier(cell), permRequest)
              ) {
                return AuthResult.deny(request, "Failed qualifier check", user, permRequest,
                  tableName, makeFamilyMap(family.getKey(), CellUtil.cloneQualifier(cell)));
              }
            }
          }
        } else {
          // no qualifiers and family-level check already failed
          return AuthResult.deny(request, "Failed family check", user, permRequest, tableName,
            makeFamilyMap(family.getKey(), null));
        }
      }

      // all family checks passed
      return AuthResult.allow(request, "All family checks passed", user, permRequest, tableName,
        families);
    }

    // 4. no families to check and table level access failed
    return AuthResult.deny(request, "No families to check and table permission failed", user,
      permRequest, tableName, families);
  }
Check the current user for authorization to perform a specific action against the given set of
row data.
<p>
Note: Ordering of the authorization checks has been carefully optimized to short-circuit the
most common requests and minimize the amount of processing required.
</p>
@param request     User request
@param user        User name
@param permRequest the action being requested
@param tableName   Table name
@param families    the map of column families to qualifiers present in the request
@return an authorization result
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessChecker.java