code: func EscalationAllowed(ctx context.Context) bool {
  	u, ok := genericapirequest.UserFrom(ctx)
  	if !ok {
  		return false
  	}
  
  	// system:masters is special because the API server uses it for privileged loopback connections
  	// therefore we know that a member of system:masters can always do anything
  	for _, group := range u.GetGroups() {
  		if group == user.SystemPrivilegedGroup {
  			return true
  		}
  	}
  
  	return false
  }
docs: // EscalationAllowed checks if the user associated with the context is a superuser