code: func vmAccessPrelude(c context.Context, methodName string, req proto.Message) (context.Context, error) {
  	groups := []string{admins, writers}
  	if isReadOnly(methodName) {
  		groups = append(groups, readers)
  	}
  	switch is, err := auth.IsMember(c, groups...); {
  	case err != nil:
  		return c, err
  	case is:
  		logging.Debugf(c, "%s called %q:\n%s", auth.CurrentIdentity(c), methodName, req)
  		// Remove the VM token to avoid restricting the user's broad access.
  		return vmtoken.Clear(c), nil
  	case isVMAccessible(methodName) && vmtoken.Has(c):
  		logging.Debugf(c, "%s called %q:\n%s", vmtoken.CurrentIdentity(c), methodName, req)
  		return c, nil
  	}
  	return c, status.Errorf(codes.PermissionDenied, "unauthorized user")
  }
docs: // vmAccessPrelude ensures the user is authorized to use the API or has
  // presented a valid GCE VM token and is attempting to use VM-accessible API.
  // Users of this prelude must perform additional authorization checks in methods
  // accepted by isVMAccessible.