code: func (a *Agent) filterChecks(token string, checks *map[types.CheckID]*structs.HealthCheck) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Filter out checks based on the node or service policy.
  	for id, check := range *checks {
  		if len(check.ServiceName) > 0 {
  			if rule.ServiceRead(check.ServiceName) {
  				continue
  			}
  		} else {
  			if rule.NodeRead(a.config.NodeName) {
  				continue
  			}
  		}
  		a.logger.Printf("[DEBUG] agent: dropping check %q from result due to ACLs", id)
  		delete(*checks, id)
  	}
  	return nil
  }
docs: // filterChecks redacts checks that the token doesn't have access to.