code: func (process *TeleportProcess) newWatcher(conn *Connector, watch services.Watch) (services.Watcher, error) {
  	if conn.ClientIdentity.ID.Role == teleport.RoleAdmin || conn.ClientIdentity.ID.Role == teleport.RoleAuth {
  		return process.localAuth.NewWatcher(process.ExitContext(), watch)
  	}
  	return conn.Client.NewWatcher(process.ExitContext(), watch)
  }
docs: // newWatcher returns a new watcher,
  // either using local auth server connection or remote client