}

	// Wait until the specified time before executing the signal.
	if t := vars.Get(peerRESTExecAt); t != "" {
		execAt, err := time.Parse(time.RFC3339Nano, vars.Get(peerRESTExecAt))
		if err != nil {
			logger.LogIf(GlobalContext, "signalservice", err)
			execAt = time.Now().Add(restartUpdateDelay)
		}
		if d := time.Until(execAt); d > 0 {
			time.Sleep(d)
		}
	}
	signal := serviceSignal(si)
	switch signal {

// policy association.
//
// - inherited from "virtual" parent - this is the case for AssumeRoleWithLDAP
// where the parent user is the DN of the actual LDAP user. The parent user
// itself cannot login, but the policy associated with them determines the base
// policy for the STS credential. The policy mapping can be updated by the
// administrator.
//
// - from `Subject.CommonName` field from the STS request for