return &rbacpb.Permission{
		Rule: &rbacpb.Permission_Metadata{
			Metadata: metadata,
		},
	}
}

func permissionHeader(header *routepb.HeaderMatcher) *rbacpb.Permission {
	return &rbacpb.Permission{
		Rule: &rbacpb.Permission_Header{
			Header: header,
		},
	}
}

func permissionPath(path *matcher.PathMatcher) *rbacpb.Permission {