code: func prepareRules(c context.Context, cfg policy.ConfigBundle, revision string) (policy.Queryable, error) {
  	parsed, ok := cfg[delegationCfg].(*admin.DelegationPermissions)
  	if !ok {
  		return nil, fmt.Errorf("wrong type of delegation.cfg - %T", cfg[delegationCfg])
  	}
  
  	rules := make([]*delegationRule, 0, len(parsed.Rules)+1)
  	for _, msg := range parsed.Rules {
  		rule, err := makeDelegationRule(c, msg)
  		if err != nil {
  			return nil, err
  		}
  		rules = append(rules, rule)
  	}
  
  	// Add an implicit rule that allows trusted LUCI microservices to grab
  	// delegation tokens for 'project:*' identities. "auth-luci-services" is a
  	// magical group also mentioned in luci-py's components.auth.
  	//
  	// TODO(vadimsh): Currently relied on by Buildbucket. Buildbucket should
  	// switch to using 'project:...' identities directly without going through
  	// the token server.
  	rule, err := makeDelegationRule(c, &admin.DelegationRule{
  		Name:                 "allow-project-identities",
  		Requestor:            []string{"group:auth-luci-services"},
  		AllowedToImpersonate: []string{Projects},
  		AllowedAudience:      []string{Requestor},
  		TargetService:        []string{"*"},
  		MaxValidityDuration:  86400,
  	})
  	if err != nil {
  		panic(err) // should be impossible, this is a hardcoded rule
  	}
  	rules = append(rules, rule)
  
  	requestors := make([]*identityset.Set, len(rules))
  	for i, r := range rules {
  		requestors[i] = r.requestors
  	}
  
  	return &Rules{
  		revision:   revision,
  		rules:      rules,
  		requestors: identityset.Union(requestors...),
  	}, nil
  }
docs: // prepareRules converts validated configs into *Rules.
  //
  // Returns them as policy.Queryable object to satisfy policy.Policy API.