code: func (f *aclFilter) filterNodeDump(dump *structs.NodeDump) {
  	nd := *dump
  	for i := 0; i < len(nd); i++ {
  		info := nd[i]
  
  		// Filter nodes
  		if node := info.Node; !f.allowNode(node) {
  			f.logger.Printf("[DEBUG] consul: dropping node %q from result due to ACLs", node)
  			nd = append(nd[:i], nd[i+1:]...)
  			i--
  			continue
  		}
  
  		// Filter services
  		for j := 0; j < len(info.Services); j++ {
  			svc := info.Services[j].Service
  			if f.allowService(svc) {
  				continue
  			}
  			f.logger.Printf("[DEBUG] consul: dropping service %q from result due to ACLs", svc)
  			info.Services = append(info.Services[:j], info.Services[j+1:]...)
  			j--
  		}
  
  		// Filter checks
  		for j := 0; j < len(info.Checks); j++ {
  			chk := info.Checks[j]
  			if f.allowService(chk.ServiceName) {
  				continue
  			}
  			f.logger.Printf("[DEBUG] consul: dropping check %q from result due to ACLs", chk.CheckID)
  			info.Checks = append(info.Checks[:j], info.Checks[j+1:]...)
  			j--
  		}
  	}
  	*dump = nd
  }
docs: // filterNodeDump is used to filter through all parts of a node dump and
  // remove elements the provided ACL token cannot access.