allowed := apps.Ns1.A
			denied := apps.Ns2.A

			from := allowed.Append(denied)
			fromMatch := match.AnyServiceName(from.NamespacedNames())
			toMatch := match.Not(fromMatch)
			to := toMatch.GetServiceMatches(apps.Ns1.All)
			fromAndTo := to.Instances().Append(from)

			config.New(t).
				Source(config.File("testdata/authz/mtls.yaml.tmpl")).
				Source(config.File("testdata/authz/allow-principal.yaml.tmpl").WithParams(