code: func AdminServerWithACL(e engine.EngineInternal, c catalog.Catalog, adminGroup string) internal.AdminServer {
  	return &internal.DecoratedAdmin{
  		Service: &adminServer{
  			Engine:  e,
  			Catalog: c,
  		},
  
  		Prelude: func(c context.Context, methodName string, req proto.Message) (context.Context, error) {
  			caller := auth.CurrentIdentity(c)
  			logging.Warningf(c, "Admin call %q by %q", methodName, caller)
  			switch yes, err := auth.IsMember(c, adminGroup); {
  			case err != nil:
  				return nil, status.Errorf(codes.Internal, "failed to check ACL")
  			case !yes:
  				return nil, status.Errorf(codes.PermissionDenied, "not an administrator")
  			default:
  				return c, nil
  			}
  		},
  
  		Postlude: func(c context.Context, methodName string, rsp proto.Message, err error) error {
  			return grpcutil.GRPCifyAndLogErr(c, err)
  		},
  	}
  }
docs: // AdminServerWithACL returns AdminServer implementation that checks all callers
  // are in the given administrator group.