code: func aclPrelude(c context.Context, methodName string, req proto.Message) (context.Context, error) {
  	acl, ok := perMethodACL[methodName]
  	if !ok {
  		panic(fmt.Sprintf("method %q is not defined in perMethodACL", methodName))
  	}
  	if acl.group != "*" {
  		switch yep, err := auth.IsMember(c, acl.group); {
  		case err != nil:
  			logging.WithError(err).Errorf(c, "IsMember(%q) failed", acl.group)
  			return nil, status.Errorf(codes.Internal, "failed to check ACL")
  		case !yep:
  			return nil, status.Errorf(codes.PermissionDenied, "not allowed")
  		}
  	}
  	if acl.check != nil {
  		if err := acl.check(c, req); err != nil {
  			return nil, err
  		}
  	}
  	return c, nil
  }
docs: // aclPrelude is called before each RPC to check ACLs.