321
}
322
if result.Decision != DecisionAllow {
324
>
// if a reason is included in the result, include it in the error message
325
>
if result.Reason != "" {
326
return nil, serviceerror.NewPermissionDenied(RequestUnauthorized, result.Reason)
327
}
328
>
return nil, errUnauthorized // return a generic error to the caller without disclosing details
interceptor.go
329
}
330
return result.Principal, nil