code: func (ac *SessionAccessControl) Evaluate() error {
  	if !ac.sessionEndTime.IsZero() && time.Now().After(ac.sessionEndTime) {
  		return errors.Errorf("client identity expired %v before", time.Since(ac.sessionEndTime))
  	}
  
  	policyCheckNeeded := !ac.usedAtLeastOnce
  
  	if currentConfigSequence := ac.sequencer.Sequence(); currentConfigSequence > ac.lastConfigSequence {
  		ac.lastConfigSequence = currentConfigSequence
  		policyCheckNeeded = true
  	}
  
  	if !policyCheckNeeded {
  		return nil
  	}
  
  	ac.usedAtLeastOnce = true
  	return ac.policyChecker.CheckPolicy(ac.envelope, ac.channelID)
  }
docs: // Evaluate uses the PolicyChecker to determine if a request should be allowed.
  // The decision is cached until the identity expires or the chain configuration
  // changes.