code: func ValidateTaskACLs(ctx *validation.Context, pSets Sets, tSets []string, tAcls []*messages.Acl) *GrantsByRole {
  	grantsLists := make([][]*messages.Acl, 0, 1+len(tSets))
  	ctx.Enter("acls")
  	validateGrants(ctx, tAcls)
  	ctx.Exit()
  	grantsLists = append(grantsLists, tAcls)
  	ctx.Enter("acl_sets")
  	for _, set := range tSets {
  		if grantsList, exists := pSets[set]; exists {
  			grantsLists = append(grantsLists, grantsList)
  		} else {
  			ctx.Errorf("referencing AclSet %q which doesn't exist", set)
  		}
  	}
  	ctx.Exit()
  	mg := mergeGrants(grantsLists...)
  	if n := len(mg.Owners) + len(mg.Readers) + len(mg.Triggerers); n > maxGrantsPerJob {
  		ctx.Errorf("Job or Trigger can have at most %d acls, but %d given", maxGrantsPerJob, n)
  	}
  	if len(mg.Owners) == 0 {
  		ctx.Errorf("Job or Trigger must have OWNER acl set")
  	}
  	return mg
  }
docs: // ValidateTaskACLs validates task's ACLs and returns TaskAcls.
  //
  // Errors are returned via validation.Context.