Function check_plan 

pub fn check_plan(
    catalog: &impl SessionCatalog,
    active_conns: Option<impl FnOnce(u32) -> Option<RoleId>>,
    session: &dyn SessionMetadata,
    plan: &Plan,
    target_cluster_id: Option<ClusterId>,
    resolved_ids: &ResolvedIds,
    sql_impl_resolved_ids: &ResolvedIds,
) -> Result<(), UnauthorizedError>

Checks if a session is authorized to execute a plan. If not, an error is returned.

sql_impl_resolved_ids contains resolved IDs discovered inside SQL-implemented function bodies during planning. These are kept separate from resolved_ids because they are implementation details of the functions, not dependencies of the statement. They are only checked by the restrict_to_user_objects restriction.