return newPolicyApplier(
		push.AuthnPolicies.GetRootNamespace(),
		nil,
		push.AuthnPolicies.GetPeerAuthenticationsForWorkload(model.PolicyMatcherFor(namespace, labels, isWaypoint)),
		push,
	)

// or the Services the workload is a part of.
type WorkloadPolicyMatcher struct {
	Namespace      string
	WorkloadLabels labels.Instance
	IsWaypoint     bool
	Service        string
}

func PolicyMatcherFor(workloadNamespace string, labels labels.Instance, isWaypoint bool) WorkloadPolicyMatcher {
	return WorkloadPolicyMatcher{
		Namespace:      workloadNamespace,
		WorkloadLabels: labels,
		IsWaypoint:     isWaypoint,
	}