code: func (a *Agent) filterMembers(token string, members *[]serf.Member) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Filter out members based on the node policy.
  	m := *members
  	for i := 0; i < len(m); i++ {
  		node := m[i].Name
  		if rule.NodeRead(node) {
  			continue
  		}
  		a.logger.Printf("[DEBUG] agent: dropping node %q from result due to ACLs", node)
  		m = append(m[:i], m[i+1:]...)
  		i--
  	}
  	*members = m
  	return nil
  }
docs: // filterMembers redacts members that the token doesn't have access to.