code: func ruleMatches(r *audit.PolicyRule, attrs authorizer.Attributes) bool {
  	user := attrs.GetUser()
  	if len(r.Users) > 0 {
  		if user == nil || !hasString(r.Users, user.GetName()) {
  			return false
  		}
  	}
  	if len(r.UserGroups) > 0 {
  		if user == nil {
  			return false
  		}
  		matched := false
  		for _, group := range user.GetGroups() {
  			if hasString(r.UserGroups, group) {
  				matched = true
  				break
  			}
  		}
  		if !matched {
  			return false
  		}
  	}
  	if len(r.Verbs) > 0 {
  		if !hasString(r.Verbs, attrs.GetVerb()) {
  			return false
  		}
  	}
  
  	if len(r.Namespaces) > 0 || len(r.Resources) > 0 {
  		return ruleMatchesResource(r, attrs)
  	}
  
  	if len(r.NonResourceURLs) > 0 {
  		return ruleMatchesNonResource(r, attrs)
  	}
  
  	return true
  }
docs: // Check whether the rule matches the request attrs.