code: func (a *Agent) vetCheckUpdate(token string, checkID types.CheckID) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Vet any changes based on the existing check's info.
  	checks := a.State.Checks()
  	if existing, ok := checks[checkID]; ok {
  		if len(existing.ServiceName) > 0 {
  			if !rule.ServiceWrite(existing.ServiceName, nil) {
  				return acl.ErrPermissionDenied
  			}
  		} else {
  			if !rule.NodeWrite(a.config.NodeName, nil) {
  				return acl.ErrPermissionDenied
  			}
  		}
  	} else {
  		return fmt.Errorf("Unknown check %q", checkID)
  	}
  
  	return nil
  }
docs: // vetCheckUpdate makes sure that a check update is allowed by the given token.