code: func (r *MintOAuthTokenViaGrantRPC) recheckRules(c context.Context, grantBody *tokenserver.OAuthTokenGrantBody) (*Rule, error) {
  	// Check that rules still allow this token (rules could have changed since
  	// the grant was generated).
  	rules, err := r.Rules(c)
  	if err != nil {
  		logging.WithError(err).Errorf(c, "Failed to load service accounts rules")
  		return nil, status.Errorf(codes.Internal, "failed to load service accounts rules")
  	}
  	return rules.Check(c, &RulesQuery{
  		ServiceAccount: grantBody.ServiceAccount,
  		Proxy:          identity.Identity(grantBody.Proxy),
  		EndUser:        identity.Identity(grantBody.EndUser),
  	})
  }
docs: // recheckRules verifies the token is still allowed by the rules.
  //
  // Returns a grpc error if the token no longer matches the rules.