'Enforce a dual approver policy for access.'

def CheckAccess(self, token):

    (namespace, _) = self.urn.Split(2)
    if (namespace != 'ACL'):
        raise access_control.UnauthorizedAccess(('Approval    object    has    invalid    urn    %s.' % self.urn), subject=self.urn, requested_access=token.requested_access)
    (user, subject_urn) = self.InferUserAndSubjectFromUrn()
    if (user != token.username):
        raise access_control.UnauthorizedAccess(('Approval    object    is    not    for    user    %s.' % token.username), subject=self.urn, requested_access=token.requested_access)
    now = rdfvalue.RDFDatetime.Now()
    break_glass = self.Get(self.Schema.BREAK_GLASS)
    if (break_glass and (now < break_glass)):
        token.is_emergency = True
        return True
    approvers = self.GetNonExpiredApprovers()
    if (len(approvers) < config.CONFIG['ACL.approvers_required']):
        msg = ('Requires    %s    approvers    for    access.' % config.CONFIG['ACL.approvers_required'])
        raise access_control.UnauthorizedAccess(msg, subject=subject_urn, requested_access=token.requested_access)
    if self.checked_approvers_label:
        approvers_with_label = []
        for approver in approvers:
            try:
                user = aff4.FACTORY.Open(('aff4:/users/%s' % approver), aff4_type=aff4_users.GRRUser, token=token.SetUID())
                if (self.checked_approvers_label in user.GetLabelsNames()):
                    approvers_with_label.append(approver)
            except IOError:
                pass
        if (len(approvers_with_label) < self.min_approvers_with_label):
            raise access_control.UnauthorizedAccess(("At    least    %d    approver(s)    should    have    '%s'    label." % (self.min_approvers_with_label, self.checked_approvers_label)), subject=subject_urn, requested_access=token.requested_access)
    return True
