code: func (a *preAuthorizer) PreAuthorize(ctx context.Context, spec *flux.Spec, auth platform.Authorizer) error {
  	readBuckets, writeBuckets, err := BucketsAccessed(spec)
  
  	if err != nil {
  		return errors.Wrap(err, "could not retrieve buckets for query.Spec")
  	}
  
  	for _, readBucketItem := range readBuckets {
  		bucket, err := a.bucketService.FindBucket(ctx, readBucketItem)
  		if err != nil {
  			return errors.Wrapf(err, "bucket does not exist")
  		}
  
  		if bucket == nil {
  			return errors.New("bucket service returned nil bucket")
  		}
  
  		reqPerm, err := platform.NewPermissionAtID(bucket.ID, platform.ReadAction, platform.BucketsResource)
  		if err != nil {
  			return errors.Wrapf(err, "could not create read bucket permission")
  		}
  
  		if !auth.Allowed(*reqPerm) {
  			return errors.New("no read permission for bucket: \"" + bucket.Name + "\"")
  		}
  	}
  
  	for _, writeBucketFilter := range writeBuckets {
  		bucket, err := a.bucketService.FindBucket(ctx, writeBucketFilter)
  		if err != nil {
  			return errors.Wrapf(err, "could not find bucket %v", writeBucketFilter)
  		}
  
  		reqPerm, err := platform.NewPermissionAtID(bucket.ID, platform.WriteAction, platform.BucketsResource)
  		if err != nil {
  			return errors.Wrapf(err, "could not create write bucket permission")
  		}
  		if !auth.Allowed(*reqPerm) {
  			return errors.New("no write permission for bucket: \"" + bucket.Name + "\"")
  		}
  	}
  
  	return nil
  }
docs: // PreAuthorize finds all the buckets read and written by the given spec, and ensures that execution is allowed
  // given the Authorizer.  Returns nil on success, and an error with an appropriate message otherwise.