code: func ValidatePrincipalName(p string) error {
  	chunks := strings.Split(p, ":")
  	if len(chunks) != 2 || chunks[0] == "" || chunks[1] == "" {
  		return fmt.Errorf("%q doesn't look like principal id (<type>:<id>)", p)
  	}
  	if chunks[0] == "group" {
  		return nil // any non-empty group name is OK
  	}
  	// Should be valid identity otherwise.
  	_, err := identity.MakeIdentity(p)
  	return err
  }
docs: // ValidatePrincipalName validates strings used to identify principals in ACLs.
  //
  // The expected format is "<key>:<value>" pair, where <key> is one of "group",
  // "user", "anonymous", "service". See also go.chromium.org/luci/auth/identity.