paramKind := policy.Spec.ParamKind
		if gv, err := schema.ParseGroupVersion(paramKind.APIVersion); err == nil {
			// we only need to authorize the parsed group/version
			apiGroup = gv.Group
			apiVersion = gv.Version
			if gvr, err := v.resourceResolver.Resolve(gv.WithKind(paramKind.Kind)); err == nil {
				// we only need to authorize the resolved resource

		allErrors = append(allErrors, field.NotSupported(fldPath.Child("failurePolicy"), *spec.FailurePolicy, supportedFailurePolicies.List()))
	}
	if spec.ParamKind != nil {
		opts.allowParamsInMatchConditions = true
		allErrors = append(allErrors, validateParamKind(*spec.ParamKind, fldPath.Child("paramKind"))...)
	}
	if spec.MatchConstraints == nil {
		allErrors = append(allErrors, field.Required(fldPath.Child("matchConstraints"), ""))
	} else {

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

  // It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy.
  // If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
  // If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
  // +optional

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

				}},
				ParamKind: &admissionregistration.ParamKind{
					APIVersion: "test.example.com/v1",
				},
			},
		},
		expectedError: `spec.paramKind.kind: Required value`,
	}, {
		name: "API version format in ParamKind",
		config: &admissionregistration.ValidatingAdmissionPolicy{
			ObjectMeta: metav1.ObjectMeta{
				Name: "config",
			},