Function token_describe_visible 

pub fn token_describe_visible(
    owner_filter_matches: bool,
    caller_is_owner: bool,
    caller_is_requester: bool,
    caller_is_renewer: bool,
    acl_allows: bool,
) -> bool

Whether one delegation token is visible to a Describe caller.

Matches DelegationTokenManager.filterToken in Kafka trunk: a caller sees a token only when the (possibly absent) owner filter matches it, and even then only as the token’s owner, its requester (the principal that created it, KIP-373), a listed renewer, or the holder of an ACL grant: Describe on that exact token, or KIP-373’s DescribeTokens on the owner’s User resource. acl_allows is either grant. The caller is never a delegation-token- authenticated identity here — token_api_admission refuses every such caller before the host ever builds this predicate, so this kernel does not re-derive that isolation; folding it into the owner/requester/renewer/ACL relation would let a filter-matching owner or ACL grant leak a token-authed caller’s sibling tokens back in.