code: func vetCheckTxnOp(op *structs.TxnCheckOp, rule acl.Authorizer) error {
  	// Fast path if ACLs are not enabled.
  	if rule == nil {
  		return nil
  	}
  
  	n := &api.Node{Node: op.Check.Node}
  	svc := &api.AgentService{
  		ID:      op.Check.ServiceID,
  		Service: op.Check.ServiceID,
  		Tags:    op.Check.ServiceTags,
  	}
  	var scope func() map[string]interface{}
  	if op.Check.ServiceID == "" {
  		// Node-level check.
  		if op.Verb == api.CheckDelete || op.Verb == api.CheckDeleteCAS {
  			scope = func() map[string]interface{} {
  				return sentinel.ScopeCatalogUpsert(n, svc)
  			}
  		}
  		if !rule.NodeWrite(op.Check.Node, scope) {
  			return acl.ErrPermissionDenied
  		}
  	} else {
  		// Service-level check.
  		if op.Verb == api.CheckDelete || op.Verb == api.CheckDeleteCAS {
  			scope = func() map[string]interface{} {
  				return sentinel.ScopeCatalogUpsert(n, svc)
  			}
  		}
  		if !rule.ServiceWrite(op.Check.ServiceName, scope) {
  			return acl.ErrPermissionDenied
  		}
  	}
  
  	return nil
  }
docs: // vetCheckTxnOp applies the given ACL policy to a check transaction operation.