code: func validateRule(ctx *validation.Context, title string, r *admin.DelegationRule) {
  	ctx.Enter(title)
  	defer ctx.Exit()
  
  	if r.Name == "" {
  		ctx.Errorf(`"name" is required`)
  	}
  
  	v := identitySetValidator{
  		Field:       "requestor",
  		Context:     ctx,
  		AllowGroups: true,
  	}
  	v.validate(r.Requestor)
  
  	v = identitySetValidator{
  		Field:              "allowed_to_impersonate",
  		Context:            ctx,
  		AllowReservedWords: []string{Requestor, Projects}, // '*' is not allowed here though
  		AllowGroups:        true,
  	}
  	v.validate(r.AllowedToImpersonate)
  
  	v = identitySetValidator{
  		Field:              "allowed_audience",
  		Context:            ctx,
  		AllowReservedWords: []string{Requestor, "*"},
  		AllowGroups:        true,
  	}
  	v.validate(r.AllowedAudience)
  
  	v = identitySetValidator{
  		Field:              "target_service",
  		Context:            ctx,
  		AllowReservedWords: []string{"*"},
  		AllowIDKinds:       []identity.Kind{identity.Service},
  	}
  	v.validate(r.TargetService)
  
  	switch {
  	case r.MaxValidityDuration == 0:
  		ctx.Errorf(`"max_validity_duration" is required`)
  	case r.MaxValidityDuration < 0:
  		ctx.Errorf(`"max_validity_duration" must be positive`)
  	case r.MaxValidityDuration > 24*3600:
  		ctx.Errorf(`"max_validity_duration" must be smaller than 86401`)
  	}
  }
docs: // validateRule checks single DelegationRule proto.
  //
  // See config.proto, DelegationRule for the description of allowed values.