code: func validateRule(ctx *validation.Context, title string, r *admin.ServiceAccountRule) {
  	ctx.Enter(title)
  	defer ctx.Exit()
  
  	if r.Name == "" {
  		ctx.Errorf(`"name" is required`)
  	}
  
  	// Note: we allow any of the sets to be empty. The rule will just not match
  	// anything in this case, this is fine.
  	validateEmails(ctx, "service_account", r.ServiceAccount)
  	validateGroups(ctx, "service_account_group", r.ServiceAccountGroup)
  	validateScopes(ctx, "allowed_scope", r.AllowedScope)
  	validateIDSet(ctx, "end_user", r.EndUser)
  	validateIDSet(ctx, "proxy", r.Proxy)
  	validateIDSet(ctx, "trusted_proxy", r.TrustedProxy)
  	validateMaxGrantValidityDuration(ctx, r.MaxGrantValidityDuration)
  }
docs: // validateRule checks single ServiceAccountRule proto.