code: func filterForPrincipalSets(channel string, evaluator principalEvaluator, sets policies.PrincipalSets) identityFilter {
  	return func(identity api.PeerIdentityType) bool {
  		// Iterate over all principal sets and ensure each principal set
  		// authorizes the identity.
  		for _, principalSet := range sets {
  			if !isIdentityAuthorizedByPrincipalSet(channel, evaluator, principalSet, identity) {
  				return false
  			}
  		}
  		return true
  	}
  }
docs: // filterForPrincipalSets creates a filter of peer identities out of the given PrincipalSets