code: func (a *Agent) resolveToken(id string) (acl.Authorizer, error) {
  	// ACLs are disabled
  	if !a.delegate.ACLsEnabled() {
  		return nil, nil
  	}
  
  	// Disable ACLs if version 8 enforcement isn't enabled.
  	if !a.config.ACLEnforceVersion8 {
  		return nil, nil
  	}
  
  	if acl.RootAuthorizer(id) != nil {
  		return nil, acl.ErrRootDenied
  	}
  
  	if a.tokens.IsAgentMasterToken(id) {
  		return a.aclMasterAuthorizer, nil
  	}
  	return a.delegate.ResolveToken(id)
  }
docs: // resolveToken is the primary interface used by ACL-checkers in the agent
  // endpoints, which is the one place where we do some ACL enforcement on
  // clients. Some of the enforcement is normative (e.g. self and monitor)
  // and some is informative (e.g. catalog and health).