code: func (set RuleSet) Match(whereParser predicate.Parser, actionsParser predicate.Parser, resource string, verb string) (bool, error) {
  	// empty set matches nothing
  	if len(set) == 0 {
  		return false, nil
  	}
  
  	// check for matching resource by name
  	// the most specific rule should win
  	rules := set[resource]
  	for _, rule := range rules {
  		match, err := rule.MatchesWhere(whereParser)
  		if err != nil {
  			return false, trace.Wrap(err)
  		}
  		if match && (rule.HasVerb(Wildcard) || rule.HasVerb(verb)) {
  			if err := rule.ProcessActions(actionsParser); err != nil {
  				return true, trace.Wrap(err)
  			}
  			return true, nil
  		}
  	}
  
  	// check for wildcard resource matcher
  	for _, rule := range set[Wildcard] {
  		match, err := rule.MatchesWhere(whereParser)
  		if err != nil {
  			return false, trace.Wrap(err)
  		}
  		if match && (rule.HasVerb(Wildcard) || rule.HasVerb(verb)) {
  			if err := rule.ProcessActions(actionsParser); err != nil {
  				return true, trace.Wrap(err)
  			}
  			return true, nil
  		}
  	}
  
  	return false, nil
  }
docs: // MatchRule tests if the resource name and verb are in a given list of rules.
  // More specific rules will be matched first. See Rule.IsMoreSpecificThan
  // for exact specs on whether the rule is more or less specific.
  //
  // Specifying order solves the problem on having multiple rules, e.g. one wildcard
  // rule can override more specific rules with 'where' sections that can have
  // 'actions' lists with side effects that will not be triggered otherwise.
  //