code: func (f *aclFilter) filterPreparedQueries(queries *structs.PreparedQueries) {
  	// Management tokens can see everything with no filtering.
  	if f.authorizer.ACLWrite() {
  		return
  	}
  
  	// Otherwise, we need to see what the token has access to.
  	ret := make(structs.PreparedQueries, 0, len(*queries))
  	for _, query := range *queries {
  		// If no prefix ACL applies to this query then filter it, since
  		// we know at this point the user doesn't have a management
  		// token, otherwise see what the policy says.
  		prefix, ok := query.GetACLPrefix()
  		if !ok || !f.authorizer.PreparedQueryRead(prefix) {
  			f.logger.Printf("[DEBUG] consul: dropping prepared query %q from result due to ACLs", query.ID)
  			continue
  		}
  
  		// Redact any tokens if necessary. We make a copy of just the
  		// pointer so we don't mess with the caller's slice.
  		final := query
  		f.redactPreparedQueryTokens(&final)
  		ret = append(ret, final)
  	}
  	*queries = ret
  }
docs: // filterPreparedQueries is used to filter prepared queries based on ACL rules.
  // We prune entries the user doesn't have access to, and we redact any tokens
  // if the user doesn't have a management token.