code: func makeRule(c context.Context, ruleProto *admin.ServiceAccountRule, defaults *admin.ServiceAccountRuleDefaults, rev string) (*Rule, error) {
  	ctx := &validation.Context{Context: c}
  	validateRule(ctx, ruleProto.Name, ruleProto)
  	if err := ctx.Finalize(); err != nil {
  		return nil, err
  	}
  
  	allowedScopes := stringset.New(len(ruleProto.AllowedScope) + len(defaults.AllowedScope))
  	for _, scope := range ruleProto.AllowedScope {
  		allowedScopes.Add(scope)
  	}
  	for _, scope := range defaults.AllowedScope {
  		allowedScopes.Add(scope)
  	}
  
  	endUsers, err := identityset.FromStrings(ruleProto.EndUser, nil)
  	if err != nil {
  		return nil, fmt.Errorf("bad 'end_user' set - %s", err)
  	}
  
  	proxies, err := identityset.FromStrings(ruleProto.Proxy, nil)
  	if err != nil {
  		return nil, fmt.Errorf("bad 'proxy' set - %s", err)
  	}
  
  	trustedProxies, err := identityset.FromStrings(ruleProto.TrustedProxy, nil)
  	if err != nil {
  		return nil, fmt.Errorf("bad 'trusted_proxy' set - %s", err)
  	}
  
  	if ruleProto.MaxGrantValidityDuration == 0 {
  		ruleProto.MaxGrantValidityDuration = defaults.MaxGrantValidityDuration
  	}
  
  	return &Rule{
  		Rule:           ruleProto,
  		Revision:       rev,
  		AllowedScopes:  allowedScopes,
  		EndUsers:       endUsers,
  		Proxies:        proxies,
  		TrustedProxies: trustedProxies,
  		AllProxies:     identityset.Union(proxies, trustedProxies),
  	}, nil
  }
docs: // makeRule converts ServiceAccountRule into queriable Rule.
  //
  // Mutates 'ruleProto' in-place filling in defaults.