code: func (set RoleSet) CheckAgentForward(login string) error {
  	// check if we have permission to login and forward agent. we don't check
  	// for deny rules because if you can't forward an agent if you can't login
  	// in the first place.
  	for _, role := range set {
  		for _, l := range role.GetLogins(Allow) {
  			if role.GetOptions().ForwardAgent.Value() && l == login {
  				return nil
  			}
  		}
  	}
  	return trace.AccessDenied("%v can not forward agent for %v", set, login)
  }
docs: // CheckAgentForward checks if the role can request to forward the SSH agent
  // for this user.