code: func (f *aclFilter) filterServiceNodes(nodes *structs.ServiceNodes) {
  	sn := *nodes
  	for i := 0; i < len(sn); i++ {
  		node := sn[i]
  		if f.allowNode(node.Node) && f.allowService(node.ServiceName) {
  			continue
  		}
  		f.logger.Printf("[DEBUG] consul: dropping node %q from result due to ACLs", node.Node)
  		sn = append(sn[:i], sn[i+1:]...)
  		i--
  	}
  	*nodes = sn
  }
docs: // filterServiceNodes is used to filter a set of nodes for a given service
  // based on the configured ACL rules.