Function classify_peer 

pub fn classify_peer(
    peer_uid: u32,
    peer_gids: &[u32],
    server_uid: u32,
    operator_gid: Option<u32>,
    reader_gid: Option<u32>,
) -> Option<PeerClass>

Classify a peer from its kernel-reported credentials, or None when the socket must refuse it. Service first, then the operator group, then the reader group, so a peer in both groups is an operator. With a group absent from the host (its gid None) nobody is admitted through it.

Pure over the credentials so the decision is testable without a second uid.