to := apps.A

			// First, expect to fail. Subset does not match
			_ = from.CallOrFail(t, echo.CallOptions{
				To: to,
				Port: echo.Port{
					Name: "http",
				},
				Count: 1,
				Check: check.BodyContains("no healthy upstream"),
			})

			lbls := map[string]string{"subset": "my-subset"}
			assert.NoError(t, to[0].UpdateWorkloadLabel(lbls, nil))
			t.Cleanup(func() {

						exRsp.ErrorMessage, err, result.Responses)
				}
				return nil
			}
			return check.And(check.NoErrorAndStatus(exRsp.StatusCode), check.BodyContains(exRsp.ErrorMessage)).Check(result, nil)
		},
	}

								// IP=10.244.2.20
								// Alpn=
								// RequestHeader=Accept:*/*
								// RequestHeader=User-Agent:curl/7.81.0
								// Hostname=uncaptured-v1-868c9b59b5-rxvfq
								Check: check.BodyContains(`Hostname=uncaptured-v`), // can hit v1 or v2
							})
						})
				})
			}
		})
}

// Ambient ServiceEntry support for auto assigned vips is lacking for now, but planned.

								HTTP: echo.HTTP{
									Path:    c.path,
									Headers: headers.New().WithHost(c.host).WithAuthz(c.token).Build(),
								},
								Check: check.And(check.NoErrorAndStatus(wantCode), check.BodyContains(body)),
							}

							from.CallOrFail(t, opts)
						})
					}
				})
		})
}

func TestAuthz_Conditions(t *testing.T) {
	framework.NewTest(t).