code: func (e *engineImpl) filterForRole(c context.Context, jobs []*Job, role acl.Role) ([]*Job, error) {
  	// TODO(tandrii): improve batch ACLs check here to take advantage of likely
  	// shared ACLs between most jobs of the same project.
  	filtered := make([]*Job, 0, len(jobs))
  	for _, job := range jobs {
  		switch err := job.CheckRole(c, role); {
  		case err == nil:
  			filtered = append(filtered, job)
  		case err != ErrNoPermission:
  			return nil, err // a transient error when checking
  		}
  	}
  	return filtered, nil
  }
docs: // filterForRole returns jobs for which caller has the given role.
  //
  // May return transient errors.