code: func isInACL(c context.Context, acl *api.PrefixMetadata_ACL) (bool, error) {
  	caller := string(auth.CurrentIdentity(c)) // e.g. "user:abc@example.com"
  
  	var groups []string
  	for _, p := range acl.Principals {
  		if p == caller {
  			return true, nil // the caller was specified in ACLs explicitly
  		}
  		if s := strings.SplitN(p, ":", 2); len(s) == 2 && s[0] == "group" {
  			groups = append(groups, s[1])
  		}
  	}
  
  	yes, err := auth.IsMember(c, groups...)
  	if err != nil {
  		return false, errors.Annotate(err, "failed to check group memberships when checking ACLs").Err()
  	}
  	return yes, nil
  }
docs: // isInACL is true if the caller is in the given access control list.