code: func WithAuthorization(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer) http.Handler {
  	if a == nil {
  		klog.Warningf("Authorization is disabled")
  		return handler
  	}
  	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
  		ctx := req.Context()
  		ae := request.AuditEventFrom(ctx)
  
  		attributes, err := GetAuthorizerAttributes(ctx)
  		if err != nil {
  			responsewriters.InternalError(w, req, err)
  			return
  		}
  		authorized, reason, err := a.Authorize(attributes)
  		// an authorizer like RBAC could encounter evaluation errors and still allow the request, so authorizer decision is checked before error here.
  		if authorized == authorizer.DecisionAllow {
  			audit.LogAnnotation(ae, decisionAnnotationKey, decisionAllow)
  			audit.LogAnnotation(ae, reasonAnnotationKey, reason)
  			handler.ServeHTTP(w, req)
  			return
  		}
  		if err != nil {
  			audit.LogAnnotation(ae, reasonAnnotationKey, reasonError)
  			responsewriters.InternalError(w, req, err)
  			return
  		}
  
  		klog.V(4).Infof("Forbidden: %#v, Reason: %q", req.RequestURI, reason)
  		audit.LogAnnotation(ae, decisionAnnotationKey, decisionForbid)
  		audit.LogAnnotation(ae, reasonAnnotationKey, reason)
  		responsewriters.Forbidden(ctx, attributes, w, req, reason, s)
  	})
  }
docs: // WithAuthorizationCheck passes all authorized requests on to handler, and returns a forbidden error otherwise.