code: func (a *authorizer) Authorize(ctx context.Context) (*AuthContext, error) {
  	if ctx == nil {
  		return nil, trace.AccessDenied("missing authentication context")
  	}
  	userI := ctx.Value(ContextUser)
  	switch user := userI.(type) {
  	case LocalUser:
  		return a.authorizeLocalUser(user)
  	case RemoteUser:
  		return a.authorizeRemoteUser(user)
  	case BuiltinRole:
  		return a.authorizeBuiltinRole(user)
  	case RemoteBuiltinRole:
  		return a.authorizeRemoteBuiltinRole(user)
  	default:
  		return nil, trace.AccessDenied("unsupported context type %T", userI)
  	}
  }
docs: // Authorize authorizes user based on identity supplied via context