code: func prefixMetadataToACLs(m *api.InheritedPrefixMetadata) (out []PackageACL) {
  	for _, p := range m.PerPrefixMetadata {
  		var acls []PackageACL
  		for _, acl := range p.Acls {
  			role := acl.Role.String()
  			found := false
  			for i, existing := range acls {
  				if existing.Role == role {
  					acls[i].Principals = append(acls[i].Principals, acl.Principals...)
  					found = true
  					break
  				}
  			}
  			if !found {
  				acls = append(acls, PackageACL{
  					PackagePath: p.Prefix,
  					Role:        role,
  					Principals:  acl.Principals,
  					ModifiedBy:  p.UpdateUser,
  					ModifiedTs:  UnixTime(google.TimeFromProto(p.UpdateTime)),
  				})
  			}
  		}
  		out = append(out, acls...)
  	}
  	return
  }
docs: // prefixMetadataToACLs extracts ACLs for a prefix and all its parent prefixes
  // from the prefix's metadata.