code: func (e *Job) CheckRole(c context.Context, role acl.Role) error {
  	switch yep, err := e.Acls.CallerHasRole(logging.SetField(c, "JobID", e.JobID), role); {
  	case err != nil:
  		return err
  	case !yep:
  		return ErrNoPermission
  	}
  	return nil
  }
docs: // CheckRole returns nil if the caller has the given role or ErrNoPermission
  // otherwise.
  //
  // May also return transient errors.