code: func isAuthorizedCall(c context.Context, s *Settings) (bool, error) {
  	// Someone from an admin group (if it is configured)? This is useful locally
  	// during development.
  	if s.AdministratorsGroup != "" {
  		switch yep, err := auth.IsMember(c, s.AdministratorsGroup); {
  		case err != nil:
  			return false, err
  		case yep:
  			return true, nil
  		}
  	}
  
  	// The config server itself (if it is configured)? May be empty when
  	// running stuff locally.
  	if s.ConfigServiceHost != "" {
  		info, err := signing.FetchServiceInfoFromLUCIService(c, "https://"+s.ConfigServiceHost)
  		if err != nil {
  			return false, err
  		}
  		caller := auth.CurrentIdentity(c)
  		if caller.Kind() == identity.User && caller.Value() == info.ServiceAccountName {
  			return true, nil
  		}
  	}
  
  	// A total stranger.
  	return false, nil
  }
docs: // isAuthorizedCall returns true if the current caller is allowed to call the
  // config validation endpoints.
  //
  // This is either the service account of the config service, or someone from
  // an admin group.