code: func (r *Rules) FindMatchingRule(c context.Context, q *RulesQuery) (*admin.DelegationRule, error) {
  	var matches []*admin.DelegationRule
  	for _, rule := range r.rules {
  		switch yes, err := rule.matchesQuery(c, q); {
  		case err != nil:
  			return nil, err // usually transient
  		case yes:
  			matches = append(matches, rule.rule)
  		}
  	}
  
  	if len(matches) == 0 {
  		return nil, fmt.Errorf("no matching delegation rules in the config")
  	}
  
  	if len(matches) > 1 {
  		names := make([]string, len(matches))
  		for i, m := range matches {
  			names[i] = fmt.Sprintf("%q", m.Name)
  		}
  		return nil, fmt.Errorf(
  			"ambiguous request, multiple delegation rules match (%s)",
  			strings.Join(names, ", "))
  	}
  
  	return matches[0], nil
  }
docs: // FindMatchingRule finds one and only one rule matching the query.
  //
  // If multiple rules match or none rules match, an error is returned.