code: func (r *Rules) MatchingRules(c context.Context, serviceAccount string) ([]*Rule, error) {
  	// TODO(vadimsh): This will not scale when the number of rules becomes large.
  	// At some point we'll have to give up the perfect consistency and start
  	// caching the results.
  
  	// Set of rules that match the service account. If the service account matches
  	// some rule via multiple different groups, this is NOT an error, since
  	// there's no ambiguity in this case.
  	matchingRules := make(map[*Rule]struct{}, 1)
  
  	// Query all groups mentioned in the config to figure out which ones the
  	// account belongs to and then pick the corresponding rules.
  	if len(r.groups) != 0 {
  		ident := identity.Identity("user:" + serviceAccount)
  		groups, err := auth.GetState(c).DB().CheckMembership(c, ident, r.groups)
  		if err != nil {
  			return nil, errors.Annotate(err, "failed to check membership of %s", serviceAccount).Err()
  		}
  		for _, g := range groups {
  			matchingRules[r.rulesPerGroup[g]] = struct{}{}
  		}
  	}
  
  	// Try rules with explicitly mentioned accounts too.
  	if rule := r.rulesPerAcc[serviceAccount]; rule != nil {
  		matchingRules[rule] = struct{}{}
  	}
  
  	// Convert to an array and sort for deterministic error messages.
  	out := make([]*Rule, 0, len(matchingRules))
  	for rule := range matchingRules {
  		out = append(out, rule)
  	}
  	sort.Slice(out, func(i, j int) bool { return out[i].Rule.Name < out[j].Rule.Name })
  	return out, nil
  }
docs: // MatchingRules returns all rules (zero or more, sorted by name) that
  // apply to the given service account.
  //
  // Returns an error if the group membership check fails.
  //
  // Relatively heavy operation, try to reuse the result.