code: func mutateACLs(meta *api.PrefixMetadata, changes []PackageACLChange) (dirty bool, err error) {
  	for _, ch := range changes {
  		role := api.Role(api.Role_value[ch.Role])
  		if role == 0 {
  			return dirty, fmt.Errorf("unrecognized role %q, not in the API definition", ch.Role)
  		}
  		changed := false
  		switch ch.Action {
  		case GrantRole:
  			changed = grantRole(meta, role, ch.Principal)
  		case RevokeRole:
  			changed = revokeRole(meta, role, ch.Principal)
  		default:
  			return dirty, fmt.Errorf("unrecognized PackageACLChangeAction %q", ch.Action)
  		}
  		dirty = dirty || changed
  	}
  	return
  }
docs: // mutateACLs applies changes to ACLs in the prefix metadata.
  //
  // Returns true if made some changes (even if ultimately failed), false if not.