Check checks the given user against the given cluster, and returns the result of the check, containing which role is assumed and which groups will be impersonated when the Kubernetes cluster is accessed.

RoleForCluster returns the role of the current user for the given cluster, and whether the role matches all clusters.

Validate validates the given access policy by running all its tests.

GroupPrefix is the special prefix used in the AccessPolicy rules to denote a group of users or clusters.

CheckResult is the result of an access policy check.