code: func (s *Intention) Match(
  	args *structs.IntentionQueryRequest,
  	reply *structs.IndexedIntentionMatches) error {
  	// Forward if necessary
  	if done, err := s.srv.forward("Intention.Match", args, args, reply); done {
  		return err
  	}
  
  	// Get the ACL token for the request for the checks below.
  	rule, err := s.srv.ResolveToken(args.Token)
  	if err != nil {
  		return err
  	}
  
  	if rule != nil {
  		// We go through each entry and test the destination to check if it
  		// matches.
  		for _, entry := range args.Match.Entries {
  			if prefix := entry.Name; prefix != "" && !rule.IntentionRead(prefix) {
  				s.srv.logger.Printf("[WARN] consul.intention: Operation on intention prefix '%s' denied due to ACLs", prefix)
  				return acl.ErrPermissionDenied
  			}
  		}
  	}
  
  	return s.srv.blockingQuery(
  		&args.QueryOptions,
  		&reply.QueryMeta,
  		func(ws memdb.WatchSet, state *state.Store) error {
  			index, matches, err := state.IntentionMatch(ws, args.Match)
  			if err != nil {
  				return err
  			}
  
  			reply.Index = index
  			reply.Matches = matches
  			return nil
  		},
  	)
  }
docs: // Match returns the set of intentions that match the given source/destination.