code: func (ac *accessController) Authorized(ctx context.Context, accessItems ...auth.Access) (context.Context, error) {
  	challenge := &authChallenge{
  		realm:        ac.realm,
  		autoRedirect: ac.autoRedirect,
  		service:      ac.service,
  		accessSet:    newAccessSet(accessItems...),
  	}
  
  	req, err := dcontext.GetRequest(ctx)
  	if err != nil {
  		return nil, err
  	}
  
  	parts := strings.Split(req.Header.Get("Authorization"), " ")
  
  	if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
  		challenge.err = ErrTokenRequired
  		return nil, challenge
  	}
  
  	rawToken := parts[1]
  
  	token, err := NewToken(rawToken)
  	if err != nil {
  		challenge.err = err
  		return nil, challenge
  	}
  
  	verifyOpts := VerifyOptions{
  		TrustedIssuers:    []string{ac.issuer},
  		AcceptedAudiences: []string{ac.service},
  		Roots:             ac.rootCerts,
  		TrustedKeys:       ac.trustedKeys,
  	}
  
  	if err = token.Verify(verifyOpts); err != nil {
  		challenge.err = err
  		return nil, challenge
  	}
  
  	accessSet := token.accessSet()
  	for _, access := range accessItems {
  		if !accessSet.contains(access) {
  			challenge.err = ErrInsufficientScope
  			return nil, challenge
  		}
  	}
  
  	ctx = auth.WithResources(ctx, token.resources())
  
  	return auth.WithUser(ctx, auth.UserInfo{Name: token.Claims.Subject}), nil
  }
docs: // Authorized handles checking whether the given request is authorized
  // for actions on resources described by the given access items.