public function areAllowed(array $actions, ClassMetadata $metadata, $document = null, ChangeSet $changeSet = null)
    {
        if (!$metadata->hasProperty('permissions')) {
            return new AllowedResult(false);
        }

        //first check the generic 'guest' role
        $result = $this->checkRolesAgainstActions(['guest'], $actions, $metadata);
        
        if (!$result->getAllowed() || $result->hasCriteria()) {
            //now load the user roles if the generic 'guest' role failed
            $roles = $this->getRoles($metadata, $document);
            $result = $this->checkRolesAgainstActions($roles, $actions, $metadata);
        }

        if (isset($document)) {
            return $this->testCritieraAgainstDocument($metadata, $document, $changeSet, $result);
        }

        return $result;
    }