code: func (a *Agent) vetServiceUpdate(token string, serviceID string) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Vet any changes based on the existing services's info.
  	services := a.State.Services()
  	if existing, ok := services[serviceID]; ok {
  		if !rule.ServiceWrite(existing.Service, nil) {
  			return acl.ErrPermissionDenied
  		}
  	} else {
  		return fmt.Errorf("Unknown service %q", serviceID)
  	}
  
  	return nil
  }
docs: // vetServiceUpdate makes sure the service update action is allowed by the given
  // token.