code: func hasGrant(c context.Context, grantsList ...[]string) (bool, error) {
  	currentIdentity := auth.CurrentIdentity(c)
  	var groups []string
  	for _, grants := range grantsList {
  		for _, grant := range grants {
  			if strings.HasPrefix(grant, "group:") {
  				groups = append(groups, grant[len("group:"):])
  				continue
  			}
  			grantedIdentity := identity.Identity(grant)
  			if !strings.ContainsRune(grant, ':') {
  				// Just email.
  				grantedIdentity = identity.Identity("user:" + grant)
  			}
  			if grantedIdentity == currentIdentity {
  				return true, nil
  			}
  		}
  	}
  	if isMember, err := auth.IsMember(c, groups...); err != nil {
  		return false, transient.Tag.Apply(err)
  	} else {
  		return isMember, nil
  	}
  }
docs: // hasGrant is current user is covered by any given grants.