// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
	//
	// See documentation for the "matchPolicy" field in the webhook configuration type.
	// +optional
	RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"`

    apiVersion: example.com/v1
    kind: CustomType
    spec:
      replicas: 1
    status:
      available: 1
  requestKind:
    group: groupValue
    kind: kindValue
    version: versionValue
  requestResource:
    group: groupValue
    resource: resourceValue
    version: versionValue
  requestSubResource: requestSubResourceValue
  resource:
    group: groupValue
    resource: resourceValue

				"request.requestKind.group == 'example.com' && request.requestKind.version == 'v1' && request.requestKind.kind == 'Fake'",
				"request.requestResource.group == 'example.com' && request.requestResource.version == 'v1' && request.requestResource.resource == 'fake' && request.requestSubResource == 'scale'",
				"request.name == 'fake-name'",
				"request.namespace == 'fake-namespace'",
				"request.operation == 'CREATE'",

      "resource": "resourceValue"
    },
    "subResource": "subResourceValue",
    "requestKind": {
      "group": "groupValue",
      "version": "versionValue",
      "kind": "kindValue"
    },
    "requestResource": {
      "group": "groupValue",
      "version": "versionValue",
      "resource": "resourceValue"
    },
    "requestSubResource": "requestSubResourceValue",
    "name": "nameValue",

    apiVersion: example.com/v1
    kind: CustomType
    spec:
      replicas: 1
    status:
      available: 1
  requestKind:
    group: groupValue
    kind: kindValue
    version: versionValue
  requestResource:
    group: groupValue
    resource: resourceValue
    version: versionValue
  requestSubResource: requestSubResourceValue
  resource:
    group: groupValue
    resource: resourceValue

	// HasParams specifies if the "params" variable is declared.
	// The "params" variable may still be bound to "null" when declared.
	HasParams bool
	// HasAuthorizer specifies if the "authorizer" and "authorizer.requestResource"
	// variables are declared. When declared, the authorizer variables are
	// expected to be non-null.
	HasAuthorizer bool

      "resource": "resourceValue"
    },
    "subResource": "subResourceValue",
    "requestKind": {
      "group": "groupValue",
      "version": "versionValue",
      "kind": "kindValue"
    },
    "requestResource": {
      "group": "groupValue",
      "version": "versionValue",
      "resource": "resourceValue"
    },
    "requestSubResource": "requestSubResourceValue",
    "name": "nameValue",

	RequestVarName                   = "request"
	NamespaceVarName                 = "namespaceObject"
	AuthorizerVarName                = "authorizer"
	RequestResourceAuthorizerVarName = "authorizer.requestResource"
	VariableVarName                  = "variables"
)

// BuildRequestType generates a DeclType for AdmissionRequest. This may be replaced with a utility that

				},
			},
			authorizer: denyAll,
		},
		{
			name: "test request resource authorizer allow check",
			validations: []ExpressionAccessor{
				&condition{
					Expression: "authorizer.requestResource.check('custom-verb').allowed()",
				},
			},
			attributes: endpointCreateAttributes(),
			results: []EvaluationResult{
				{
					EvalResult: celtypes.True,
				},
			},

  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
  //   request resource.
  // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
  //
  // Required.