code: func (a *Agent) vetServiceRegister(token string, service *structs.NodeService) error {
  	// Resolve the token and bail if ACLs aren't enabled.
  	rule, err := a.resolveToken(token)
  	if err != nil {
  		return err
  	}
  	if rule == nil {
  		return nil
  	}
  
  	// Vet the service itself.
  	if !rule.ServiceWrite(service.Service, nil) {
  		return acl.ErrPermissionDenied
  	}
  
  	// Vet any service that might be getting overwritten.
  	services := a.State.Services()
  	if existing, ok := services[service.ID]; ok {
  		if !rule.ServiceWrite(existing.Service, nil) {
  			return acl.ErrPermissionDenied
  		}
  	}
  
  	// If the service is a proxy, ensure that it has write on the destination too
  	// since it can be discovered as an instance of that service.
  	if service.Kind == structs.ServiceKindConnectProxy {
  		if !rule.ServiceWrite(service.Proxy.DestinationServiceName, nil) {
  			return acl.ErrPermissionDenied
  		}
  	}
  
  	return nil
  }
docs: // vetServiceRegister makes sure the service registration action is allowed by
  // the given token.