code: func (a *ACLs) belongsTo(c context.Context, readerGroups ...[]string) (bool, error) {
  	currentIdentity := auth.CurrentIdentity(c)
  	groups := []string{}
  	for _, readers := range readerGroups {
  		for _, r := range readers {
  			switch {
  			case strings.HasPrefix(r, "group:"):
  				// auth.IsMember expects group names w/o "group:" prefix.
  				groups = append(groups, r[len("group:"):])
  			case currentIdentity == identity.Identity(r):
  				return true, nil
  			}
  		}
  	}
  	isMember, err := auth.IsMember(c, groups...)
  	if err != nil {
  		return false, transient.Tag.Apply(err)
  	}
  	return isMember, nil
  }
docs: // private implementation.