code: func validateServiceAccountsCfg(ctx *validation.Context, cfg *admin.ServiceAccountsPermissions) {
  	if cfg.Defaults != nil {
  		validateDefaults(ctx, "defaults", cfg.Defaults)
  	}
  
  	names := stringset.New(0)
  	accounts := map[string]string{} // service account -> rule name where its defined
  	groups := map[string]string{}   // group with accounts -> rule name where its defined
  	for i, rule := range cfg.Rules {
  		// Rule name must be unique. Missing name will be handled by 'validateRule'.
  		if rule.Name != "" {
  			if names.Has(rule.Name) {
  				ctx.Errorf("two rules with identical name %q", rule.Name)
  			} else {
  				names.Add(rule.Name)
  			}
  		}
  
  		// There should be no overlap between service account sets covered by each
  		// rule. Unfortunately we can't reliably dive into groups, since they may
  		// change after the config validation step. So compare only top level group
  		// names, Rules.Rule() method relies on this.
  		for _, account := range rule.ServiceAccount {
  			if name, ok := accounts[account]; ok {
  				ctx.Errorf("service account %q is mentioned by more than one rule (%q and %q)", account, name, rule.Name)
  			} else {
  				accounts[account] = rule.Name
  			}
  		}
  		for _, group := range rule.ServiceAccountGroup {
  			if name, ok := groups[group]; ok {
  				ctx.Errorf("service account group %q is mentioned by more than one rule (%q and %q)", group, name, rule.Name)
  			} else {
  				groups[group] = rule.Name
  			}
  		}
  
  		validateRule(ctx, fmt.Sprintf("rule #%d: %q", i+1, rule.Name), rule)
  	}
  }
docs: // validateServiceAccountsCfg checks deserialized service_accounts.cfg.