code: func getByID(c context.Context, id string) (*instances.Instance, error) {
  	if vmtoken.Has(c) {
  		return nil, status.Errorf(codes.PermissionDenied, "unauthorized user")
  	}
  	vm := &model.VM{
  		ID: id,
  	}
  	switch err := datastore.Get(c, vm); {
  	case err == datastore.ErrNoSuchEntity:
  		return nil, status.Errorf(codes.NotFound, "no VM found with ID %q", id)
  	case err != nil:
  		return nil, errors.Annotate(err, "failed to fetch VM").Err()
  	default:
  		return toInstance(vm), nil
  	}
  }
docs: // getByID returns the *instances.Instance matching the given ID. Always returns
  // permission denied when called by VMs.