allowPolicies:     policies.Allow,
		auditPolicies:     policies.Audit,
		trustDomainBundle: trustDomainBundle,
		option:            option,
	}
}

// BuildHTTP returns the HTTP filters built from the authorization policy.
func (b Builder) BuildHTTP() []*hcm.HttpFilter {
	b.logger = &AuthzLogger{}
	defer b.logger.Report()
	if b.option.IsCustomBuilder {

		filters = append(filters, lb.authzCustomBuilder.BuildHTTP(httpOpts.class)...)
		filters = extension.PopAppendHTTP(filters, wasm, extensions.PluginPhase_AUTHN)
		filters = append(filters, lb.authnBuilder.BuildHTTP(httpOpts.class)...)
		filters = extension.PopAppendHTTP(filters, wasm, extensions.PluginPhase_AUTHZ)
		filters = append(filters, lb.authzBuilder.BuildHTTP(httpOpts.class)...)

	pre = append(pre, authzCustomBuilder.BuildHTTP(cls)...)
	pre = extension.PopAppendHTTP(pre, wasm, extensions.PluginPhase_AUTHN)
	pre = append(pre, authnBuilder.BuildHTTP(cls)...)
	pre = extension.PopAppendHTTP(pre, wasm, extensions.PluginPhase_AUTHZ)
	pre = append(pre, authzBuilder.BuildHTTP(cls)...)

				policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
				g := New(tc.tdBundle, push, policies, option)
				if g == nil {
					t.Fatalf("failed to create generator")
				}
				got := g.BuildHTTP()
				wants := tc.want
				if extended {
					for i := range wants {
						wants[i] = "extended-" + wants[i]
					}
				}
				verify(t, convertHTTP(got), baseDir, tc.want, false /* forTCP */)
			})