return isOwnerDerived || combinedPolicy.IsAllowed(parentArgs)
	}

	// 3. If an inline session-policy is present, evaluate it.
	hasSessionPolicy, isAllowedSP := isAllowedBySessionPolicyForServiceAccount(args)
	if hasSessionPolicy {
		return isAllowedSP && (isOwnerDerived || combinedPolicy.IsAllowed(parentArgs))
	}

	// Sub policy not set. Evaluate only the parent policies.