code: func adminPrelude(serviceName string) func(context.Context, string, proto.Message) (context.Context, error) {
  	return func(c context.Context, method string, _ proto.Message) (context.Context, error) {
  		logging.Infof(c, "%s: %q is calling %q", serviceName, auth.CurrentIdentity(c), method)
  		switch admin, err := auth.IsMember(c, "administrators"); {
  		case err != nil:
  			return nil, status.Errorf(codes.Internal, "can't check ACL - %s", err)
  		case !admin:
  			return nil, status.Errorf(codes.PermissionDenied, "not an admin")
  		}
  		return c, nil
  	}
  }
docs: // adminPrelude returns a prelude that authorizes only administrators.