code: func (a *Agent) vetCheckRegister(token string, check *structs.HealthCheck) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Vet the check itself.
  	if len(check.ServiceName) > 0 {
  		if !rule.ServiceWrite(check.ServiceName, nil) {
  			return acl.ErrPermissionDenied
  		}
  	} else {
  		if !rule.NodeWrite(a.config.NodeName, nil) {
  			return acl.ErrPermissionDenied
  		}
  	}
  
  	// Vet any check that might be getting overwritten.
  	checks := a.State.Checks()
  	if existing, ok := checks[check.CheckID]; ok {
  		if len(existing.ServiceName) > 0 {
  			if !rule.ServiceWrite(existing.ServiceName, nil) {
  				return acl.ErrPermissionDenied
  			}
  		} else {
  			if !rule.NodeWrite(a.config.NodeName, nil) {
  				return acl.ErrPermissionDenied
  			}
  		}
  	}
  
  	return nil
  }
docs: // vetCheckRegister makes sure the check registration action is allowed by the
  // given token.