code: func authPrelude(c context.Context, methodName string, req proto.Message) (context.Context, error) {
  	groups := []string{"machine-db-administrators", "machine-db-writers"}
  	if strings.HasPrefix(methodName, "Find") || strings.HasPrefix(methodName, "List") {
  		groups = append(groups, "machine-db-readers")
  	}
  	switch is, err := auth.IsMember(c, groups...); {
  	case err != nil:
  		return c, err
  	case !is:
  		return c, status.Errorf(codes.PermissionDenied, "unauthorized user")
  	}
  	logging.Debugf(c, "%s called %q:\n%s", auth.CurrentIdentity(c), methodName, req)
  	return c, nil
  }
docs: // authPrelude ensures the user is authorized to use the Crimson API.