code: func (r *MintOAuthTokenGrantRPC) checkRules(c context.Context, req *minter.MintOAuthTokenGrantRequest, caller identity.Identity) (*Rule, error) {
  	rules, err := r.Rules(c)
  	if err != nil {
  		logging.WithError(err).Errorf(c, "Failed to load service accounts rules")
  		return nil, status.Errorf(codes.Internal, "failed to load service accounts rules")
  	}
  
  	rule, err := rules.Check(c, &RulesQuery{
  		ServiceAccount: req.ServiceAccount,
  		Proxy:          caller,
  		EndUser:        identity.Identity(req.EndUser),
  	})
  	if err != nil {
  		return nil, err // it is already gRPC error, and it's already logged
  	}
  
  	// ValidityDuration check is specific to this RPC, it's not done by 'Check'.
  	if req.ValidityDuration > rule.Rule.MaxGrantValidityDuration {
  		logging.Errorf(c, "Requested validity is larger than max allowed: %d > %d", req.ValidityDuration, rule.Rule.MaxGrantValidityDuration)
  		return nil, status.Errorf(codes.InvalidArgument, "per rule %q the validity duration should be <= %d", rule.Rule.Name, rule.Rule.MaxGrantValidityDuration)
  	}
  
  	// Note that AllowedScopes is checked later during MintOAuthTokenViaGrant.
  	// Here we don't even know what OAuth scopes will be requested.
  
  	return rule, nil
  }
docs: // checkRules verifies the requested token is allowed by the rules.
  //
  // Returns the matching rule or a grpc error.