assertThat(pathMatcher(matcher), instanceOf(AnythingMatcher.class));
        assertThat(matcher, matchesFile());
        assertThat(matcher, matchesFile("a"));
        assertThat(matcher, matchesFile("a", "b", "c"));

        matcher = PatternMatcherFactory.getPatternMatcher(false, true, "**/");
        assertThat(pathMatcher(matcher), instanceOf(AnythingMatcher.class));

	attrEnvoyFilter      = "experimental.envoy.filters." // an experimental attribute for checking Envoy Metadata directly.

	// Internal names used to generate corresponding Envoy matcher.
	methodHeader = ":method"
	pathMatcher  = "path-matcher"
	hostHeader   = ":authority"
)

type rule struct {
	key       string
	values    []string
	notValues []string
	g         generator
	// This generator aggregates value predicates

		return nil, fmt.Errorf("%q is HTTP only", key)
	}

	if security.ContainsPathTemplate(value) {
		m := matcher.PathTemplateMatcher(value)
		return permissionPathTemplate(m), nil
	}

	m := matcher.PathMatcher(value)
	return permissionPath(m), nil
}

func (pathGenerator) principal(key, value string, forTCP bool, _ bool) (*rbacpb.Principal, error) {
	return nil, fmt.Errorf("unimplemented")
}