UseExtendedJwt:  extended,
				}
				push := push(t, baseDir+tc.input, tc.meshConfig)
				proxy := node(tc.version)
				selectionOpts := model.PolicyMatcherForProxy(proxy)
				policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
				g := New(tc.tdBundle, push, policies, option)
				if g == nil {
					t.Fatalf("failed to create generator")
				}
				got := g.BuildHTTP()
				wants := tc.want
				if extended {

			},
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			authzPolicies := createFakeAuthorizationPolicies(tc.configs)

			result := authzPolicies.ListAuthorizationPolicies(tc.selectionOpts)
			if !reflect.DeepEqual(tc.wantAllow, result.Allow) {
				t.Errorf("wantAllow:%v\n but got: %v\n", tc.wantAllow, result.Allow)
			}
			if !reflect.DeepEqual(tc.wantDeny, result.Deny) {

	// grpc supports ALLOW and DENY actions (fail if it is not one of them), so we can't use the normal generator
	selectionOpts := model.PolicyMatcherForProxy(node)
	policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
	if len(policies.Deny)+len(policies.Allow) > 0 {
		rules := buildRBAC(node, push, nameSuffix, tlsContext, rbacpb.RBAC_DENY, policies.Deny)
		if rules != nil && len(rules.Policies) > 0 {