code: func readOnlyAuthPrelude(c context.Context, methodName string, req proto.Message) (context.Context, error) {
  	if !isReadOnly(methodName) {
  		return c, status.Errorf(codes.PermissionDenied, "unauthorized user")
  	}
  	switch is, err := auth.IsMember(c, admins, writers, readers); {
  	case err != nil:
  		return c, err
  	case is:
  		logging.Debugf(c, "%s called %q:\n%s", auth.CurrentIdentity(c), methodName, req)
  		return c, nil
  	}
  	return c, status.Errorf(codes.PermissionDenied, "unauthorized user")
  }
docs: // readOnlyAuthPrelude ensures the user is authorized to use read API methods.
  // Always returns permission denied for write API methods.