code: func ConfirmNoEscalation(ctx context.Context, ruleResolver AuthorizationRuleResolver, rules []rbacv1.PolicyRule) error {
  	ruleResolutionErrors := []error{}
  
  	user, ok := genericapirequest.UserFrom(ctx)
  	if !ok {
  		return fmt.Errorf("no user on context")
  	}
  	namespace, _ := genericapirequest.NamespaceFrom(ctx)
  
  	ownerRules, err := ruleResolver.RulesFor(user, namespace)
  	if err != nil {
  		// As per AuthorizationRuleResolver contract, this may return a non fatal error with an incomplete list of policies. Log the error and continue.
  		klog.V(1).Infof("non-fatal error getting local rules for %v: %v", user, err)
  		ruleResolutionErrors = append(ruleResolutionErrors, err)
  	}
  
  	ownerRightsCover, missingRights := Covers(ownerRules, rules)
  	if !ownerRightsCover {
  		compactMissingRights := missingRights
  		if compact, err := CompactRules(missingRights); err == nil {
  			compactMissingRights = compact
  		}
  
  		missingDescriptions := sets.NewString()
  		for _, missing := range compactMissingRights {
  			missingDescriptions.Insert(rbacv1helpers.CompactString(missing))
  		}
  
  		msg := fmt.Sprintf("user %q (groups=%q) is attempting to grant RBAC permissions not currently held:\n%s", user.GetName(), user.GetGroups(), strings.Join(missingDescriptions.List(), "\n"))
  		if len(ruleResolutionErrors) > 0 {
  			msg = msg + fmt.Sprintf("; resolution errors: %v", ruleResolutionErrors)
  		}
  
  		return errors.New(msg)
  	}
  	return nil
  }
docs: // ConfirmNoEscalation determines if the roles for a given user in a given namespace encompass the provided role.