code: func checkAdminPrelude(c context.Context, method string, req proto.Message) (context.Context, error) {
  	switch yep, err := auth.IsMember(c, AdminGroup); {
  	case err != nil:
  		logging.WithError(err).Errorf(c, "IsMember(%q) failed", AdminGroup)
  		return nil, status.Errorf(codes.Internal, "failed to check ACL")
  	case !yep:
  		logging.Warningf(c, "Denying access to %q for %q, not in %q group", method, auth.CurrentIdentity(c), AdminGroup)
  		return nil, status.Errorf(codes.PermissionDenied, "not allowed")
  	}
  	logging.Infof(c, "Admin %q is calling %q", auth.CurrentIdentity(c), method)
  	return c, nil
  }
docs: // checkAdminPrelude is called before each RPC to check the caller is in
  // "administrators" group.