code: func (s *Server) handleAgentForwardProxy(req *ssh.Request, ctx *srv.ServerContext) error {
  	// Forwarding an agent to the proxy is only supported when the proxy is in
  	// recording mode.
  	if ctx.ClusterConfig.GetSessionRecording() != services.RecordAtProxy {
  		return trace.BadParameter("agent forwarding to proxy only supported in recording mode")
  	}
  
  	// Check if the user's RBAC role allows agent forwarding.
  	err := s.authHandlers.CheckAgentForward(ctx)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// Open a channel to the client where the client will serve an agent.
  	authChannel, _, err := ctx.Conn.OpenChannel(sshutils.AuthAgentRequest, nil)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// Save the agent so it can be used when making a proxy subsystem request
  	// later. It will also be used when building a remote connection to the
  	// target node.
  	ctx.SetAgent(agent.NewClient(authChannel), authChannel)
  
  	return nil
  }
docs: // handleAgentForwardProxy will forward the clients agent to the proxy (when
  // the proxy is running in recording mode). When running in normal mode, this
  // request will do nothing. To maintain interoperability, agent forwarding
  // requests should never fail, all errors should be logged and we should
  // continue processing requests.