if hasSessionPolicy {
		return isAllowedSP && (isOwnerDerived || combinedPolicy.IsAllowed(args))
	}

	// Sub policy not set, this is most common since subPolicy
	// is optional, use the inherited policies.
	return isOwnerDerived || combinedPolicy.IsAllowed(args)
}

func isAllowedBySessionPolicyForServiceAccount(args policy.Args) (hasSessionPolicy bool, isAllowed bool) {

	Time      string
}

func (args vsArgs) Config(t *testing.T, variant string) string {
	if args.Time == "" {
		args.Time = TimeBase
	}

	if args.Matches == nil {
		args.Matches = []string{args.Match}
	}
	if variant == "httproute" {
		if args.GwMatches == nil {
			args.GwMatches = make([]types.NamespacedName, 0, len(args.Matches))
			for _, m := range args.Matches {
				spl := strings.Split(m, ".")

		n := 0
		// Use the following trick to filter in place
		// https://github.com/golang/go/wiki/SliceTricks#filter-in-place
		for _, bucketInfo := range bucketsInfo {
			if globalIAMSys.IsAllowed(policy.Args{
				AccountName:     cred.AccessKey,
				Groups:          cred.Groups,
				Action:          policy.ListBucketAction,
				BucketName:      bucketInfo.Name,
				ConditionValues: getConditionValues(r, "", cred),