code: func (a *Agent) filterServices(token string, services *map[string]*structs.NodeService) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Filter out services based on the service policy.
  	for id, service := range *services {
  		if rule.ServiceRead(service.Service) {
  			continue
  		}
  		a.logger.Printf("[DEBUG] agent: dropping service %q from result due to ACLs", id)
  		delete(*services, id)
  	}
  	return nil
  }
docs: // filterServices redacts services that the token doesn't have access to.