public function assert(
        Acl $acl,
        RoleInterface $role = null,
        ResourceInterface $resource = null,
        $privilege = null
    ) {
        if (!$role instanceof UserInterface || !$resource instanceof ApplicationInterface) {
            return false;
        }

        /* @var $resource ApplicationInterface|DraftableEntityInterface */

        $permissions = $resource->getPermissions();

        /* If application is a draft, only the associated user may view and edit.
         * As an anonymous user is not saved with the entity, we need to check the 'change' permission.
         */
        if ($resource->isDraft()) {
            return $role === $resource->getUser() || $permissions->isGranted($role, PermissionsInterface::PERMISSION_CHANGE);
        }

        if (ApplicationInterface::PERMISSION_SUBSEQUENT_ATTACHMENT_UPLOAD == $privilege) {
            // only applicant is allowed to upload subsequent attachments
            return $permissions->isAssigned($role) && $permissions->isGranted($role, PermissionsInterface::PERMISSION_VIEW);
        }
        
        $permission = 'read' == $privilege ? PermissionsInterface::PERMISSION_VIEW : PermissionsInterface::PERMISSION_CHANGE;
        return $permissions->isGranted($role, $permission);
    }