code: func (a *ACL) Apply(args *structs.ACLRequest, reply *string) error {
  	if done, err := a.srv.forward("ACL.Apply", args, args, reply); done {
  		return err
  	}
  	defer metrics.MeasureSince([]string{"acl", "apply"}, time.Now())
  
  	// Verify we are allowed to serve this request
  	if !a.srv.ACLsEnabled() {
  		return acl.ErrDisabled
  	}
  
  	// Verify token is permitted to modify ACLs
  	if rule, err := a.srv.ResolveToken(args.Token); err != nil {
  		return err
  	} else if rule == nil || !rule.ACLWrite() {
  		return acl.ErrPermissionDenied
  	}
  
  	// If no ID is provided, generate a new ID. This must be done prior to
  	// appending to the Raft log, because the ID is not deterministic. Once
  	// the entry is in the log, the state update MUST be deterministic or
  	// the followers will not converge.
  	if args.Op == structs.ACLSet && args.ACL.ID == "" {
  		var err error
  		args.ACL.ID, err = lib.GenerateUUID(a.srv.checkTokenUUID)
  		if err != nil {
  			return err
  		}
  	}
  
  	// Do the apply now that this update is vetted.
  	if err := aclApplyInternal(a.srv, args, reply); err != nil {
  		return err
  	}
  
  	// Clear the cache if applicable
  	if args.ACL.ID != "" {
  		a.srv.acls.cache.RemoveIdentity(args.ACL.ID)
  	}
  
  	return nil
  }
docs: // Apply is used to apply a modifying request to the data store. This should
  // only be used for operations that modify the data