code: func (a *ACL) PolicyResolve(args *structs.ACLPolicyBatchGetRequest, reply *structs.ACLPolicyBatchResponse) error {
  	if err := a.aclPreCheck(); err != nil {
  		return err
  	}
  
  	if done, err := a.srv.forward("ACL.PolicyResolve", args, args, reply); done {
  		return err
  	}
  
  	// get full list of policies for this token
  	identity, policies, err := a.srv.acls.resolveTokenToIdentityAndPolicies(args.Token)
  	if err != nil {
  		return err
  	}
  
  	idMap := make(map[string]*structs.ACLPolicy)
  	for _, policyID := range identity.PolicyIDs() {
  		idMap[policyID] = nil
  	}
  	for _, policy := range policies {
  		idMap[policy.ID] = policy
  	}
  
  	for _, policyID := range args.PolicyIDs {
  		if policy, ok := idMap[policyID]; ok {
  			// only add non-deleted policies
  			if policy != nil {
  				reply.Policies = append(reply.Policies, policy)
  			}
  		} else {
  			// send a permission denied to indicate that the request included
  			// policy ids not associated with this token
  			return acl.ErrPermissionDenied
  		}
  	}
  
  	a.srv.setQueryMeta(&reply.QueryMeta)
  
  	return nil
  }
docs: // PolicyResolve is used to retrieve a subset of the policies associated with a given token
  // The policy ids in the args simply act as a filter on the policy set assigned to the token