code: func AuthorizeForwardedRoleAndOrg(ctx context.Context, authorizedRoles, forwarderRoles []string, org string, blacklistedCerts map[string]*api.BlacklistedCertificate) (string, error) {
  	if isForwardedRequest(ctx) {
  		_, err := AuthorizeOrgAndRole(ctx, org, blacklistedCerts, forwarderRoles...)
  		if err != nil {
  			return "", status.Errorf(codes.PermissionDenied, "Permission denied: unauthorized forwarder role: %v", err)
  		}
  
  		// This was a forwarded request. Authorize the forwarder, and
  		// check if the forwarded role matches one of the authorized
  		// roles.
  		_, forwardedID, forwardedOrg, forwardedOUs := forwardedTLSInfoFromContext(ctx)
  
  		if len(forwardedOUs) == 0 || forwardedID == "" || forwardedOrg == "" {
  			return "", status.Errorf(codes.PermissionDenied, "Permission denied: missing information in forwarded request")
  		}
  
  		if !intersectArrays(forwardedOUs, authorizedRoles) {
  			return "", status.Errorf(codes.PermissionDenied, "Permission denied: unauthorized forwarded role, expecting: %v", authorizedRoles)
  		}
  
  		if forwardedOrg != org {
  			return "", status.Errorf(codes.PermissionDenied, "Permission denied: organization mismatch, expecting: %s", org)
  		}
  
  		return forwardedID, nil
  	}
  
  	// There wasn't any node being forwarded, check if this is a direct call by the expected role
  	nodeID, err := AuthorizeOrgAndRole(ctx, org, blacklistedCerts, authorizedRoles...)
  	if err == nil {
  		return nodeID, nil
  	}
  
  	return "", status.Errorf(codes.PermissionDenied, "Permission denied: unauthorized peer role: %v", err)
  }
docs: // AuthorizeForwardedRoleAndOrg checks for proper roles and organization of caller. The RPC may have
  // been proxied by a manager, in which case the manager is authenticated and
  // so is the certificate information that it forwarded. It returns the node ID
  // of the original client.