allErrs = append(allErrs, field.Invalid(field.NewPath("metadata"), sar.ObjectMeta, `must be empty except for namespace`))
	}

	if sar.Spec.ResourceAttributes != nil && sar.Spec.ResourceAttributes.Namespace != sar.Namespace {
		allErrs = append(allErrs, field.Invalid(field.NewPath("spec.resourceAttributes.namespace"), sar.Spec.ResourceAttributes.Namespace, `must match metadata.namespace`))
	}
	if sar.Spec.NonResourceAttributes != nil {

		extra[k] = authorization.ExtraValue(v)
	}

	sar := &authorization.SubjectAccessReview{
		Spec: authorization.SubjectAccessReviewSpec{
			User:               csr.Spec.Username,
			UID:                csr.Spec.UID,
			Groups:             csr.Spec.Groups,
			Extra:              extra,
			ResourceAttributes: &rattrs,
		},
	}

Authors. All rights reserved.
L2:// Use of this source code is governed by a BSD-style
L3:// license that can be found in the LICENSE file.
L4:
L5:// Prefer SARX/SHLX/SHRX instruction because it has less register restriction on the shift input.
L6:(SAR(Q|L) x y) && buildcfg.GOAMD64 >= 3 => (SARX(Q|L) x y)
L7:(SHL(Q|L) x y) && buildcfg.GOAMD64 >= 3 => (SHLX(Q|L) x y)
L8:(SHR(Q|L) x y) && buildcfg.GOAMD64 >= 3 => (SHRX(Q|L) x y)
L9:
L10:// See comments in ARM64latelower.rules for why these are here.
...

	s.AlwaysAllowPaths = append(s.AlwaysAllowPaths, paths...)
	return s
}

// WithClientTimeout sets the given timeout for SAR client used by this authorizer
func (s *DelegatingAuthorizationOptions) WithClientTimeout(timeout time.Duration) {
	s.ClientTimeout = timeout
}

	OUT:       true,
	POP:       true,
	POPA:      true,
	POPCNT:    true,
	PUSH:      true,
	PUSHA:     true,
	RCL:       true,
	RCR:       true,
	ROL:       true,
	ROR:       true,
	SAR:       true,
	SBB:       true,
	SHL:       true,
	SHLD:      true,
	SHR:       true,
	SHRD:      true,
	SUB:       true,
	TEST:      true,
	XADD:      true,
	XCHG:      true,
	XOR:       true,