code: func validateAuthGroup(name string, groups map[string]*protocol.AuthGroup) error {
  	g := groups[name]
  
  	for _, ident := range g.GetMembers() {
  		if _, err := identity.MakeIdentity(ident); err != nil {
  			return fmt.Errorf("auth: invalid identity %q in group %q - %s", ident, name, err)
  		}
  	}
  
  	for _, glob := range g.GetGlobs() {
  		if _, err := identity.MakeGlob(glob); err != nil {
  			return fmt.Errorf("auth: invalid glob %q in group %q - %s", glob, name, err)
  		}
  	}
  
  	for _, nested := range g.GetNested() {
  		if groups[nested] == nil {
  			return fmt.Errorf("auth: unknown nested group %q in group %q", nested, name)
  		}
  	}
  
  	if cycle := findGroupCycle(name, groups); len(cycle) != 0 {
  		return fmt.Errorf("auth: dependency cycle found - %v", cycle)
  	}
  
  	return nil
  }
docs: // validateAuthGroup returns nil if AuthGroup looks correct.