code: func checkSubtokenServices(t *messages.Subtoken, serviceID identity.Identity) error {
  	// Empty services field is not allowed.
  	if len(t.Services) == 0 {
  		return fmt.Errorf("the token's services list is empty")
  	}
  	// Else, make sure we are in the 'services' list or it contains '*'.
  	for _, allowed := range t.Services {
  		if allowed == "*" || allowed == string(serviceID) {
  			return nil
  		}
  	}
  	return fmt.Errorf("token is not intended for %s", serviceID)
  }
docs: // checkSubtokenServices makes sure the token is usable by the current service.