code: func vetServiceTxnOp(op *structs.TxnServiceOp, rule acl.Authorizer) error {
  	// Fast path if ACLs are not enabled.
  	if rule == nil {
  		return nil
  	}
  
  	service := op.Service
  
  	n := &api.Node{Node: op.Node}
  	svc := &api.AgentService{
  		ID:                service.ID,
  		Service:           service.Service,
  		Tags:              service.Tags,
  		Meta:              service.Meta,
  		Address:           service.Address,
  		Port:              service.Port,
  		EnableTagOverride: service.EnableTagOverride,
  	}
  	var scope func() map[string]interface{}
  	if op.Verb != api.ServiceDelete && op.Verb != api.ServiceDeleteCAS {
  		scope = func() map[string]interface{} {
  			return sentinel.ScopeCatalogUpsert(n, svc)
  		}
  	}
  	if !rule.ServiceWrite(service.Service, scope) {
  		return acl.ErrPermissionDenied
  	}
  
  	return nil
  }
docs: // vetServiceTxnOp applies the given ACL policy to a service transaction operation.