code: func (rule *delegationRule) matchesQuery(c context.Context, q *RulesQuery) (bool, error) {
  	// Rule's 'requestor' set contains the requestor?
  	switch found, err := rule.requestors.IsMember(c, q.Requestor); {
  	case err != nil:
  		return false, err
  	case !found:
  		return false, nil
  	}
  
  	// Rule's 'delegators' set contains the identity being delegated/impersonated?
  	switch yes, err := rule.matchesDelegator(c, q); {
  	case err != nil:
  		return false, err
  	case !yes:
  		return false, nil
  	}
  
  	// Rule's 'audience' is superset of requested audience?
  	allowedAudience := rule.audience
  	if rule.addRequestorToAudience {
  		allowedAudience = identityset.Extend(allowedAudience, q.Requestor)
  	}
  	if !allowedAudience.IsSuperset(q.Audience) {
  		return false, nil
  	}
  
  	// Rule's allowed targets is superset of requested targets?
  	if !rule.services.IsSuperset(q.Services) {
  		return false, nil
  	}
  
  	return true, nil
  }
docs: // matchesQuery returns true if this rule matches the query.
  //
  // See doc in config.proto, DelegationRule for exact description of when this
  // happens. Basically, all sets in rule must be supersets of corresponding sets
  // in RulesQuery.
  //
  // May return transient errors.