code: func (msp *bccspmsp) hasOURole(id Identity, mspRole m.MSPRole_MSPRoleType) error {
  	// Check NodeOUs
  	if !msp.ouEnforcement {
  		return errors.New("NodeOUs not activated. Cannot tell apart identities.")
  	}
  
  	mspLogger.Debugf("MSP %s checking if the identity is a client", msp.name)
  
  	switch id := id.(type) {
  	// If this identity is of this specific type,
  	// this is how I can validate it given the
  	// root of trust this MSP has
  	case *identity:
  		return msp.hasOURoleInternal(id, mspRole)
  	default:
  		return errors.New("Identity type not recognized")
  	}
  }
docs: // hasOURole checks that the identity belongs to the organizational unit
  // associated to the specified MSPRole.
  // This function does not check the certifiers identifier.
  // Appropriate validation needs to be enforced before.