assert.Equal(t,
		s.lookup(s.addrXdsName("127.0.0.1"))[0].GetWorkload().GetAuthorizationPolicies(),
		nil)
	s.clearEvents()

	s.addPolicy(t, "selector", "ns1", map[string]string{"app": "a"}, gvk.AuthorizationPolicy, nil)
	s.assertEvent(t, s.wleXdsName("name1"))
	assert.Equal(t,
		s.lookup(s.addrXdsName("127.0.0.1"))[0].GetWorkload().GetAuthorizationPolicies(),
		[]string{"ns1/selector"})

	// WorkloadEntry not in policy

	// The name of the root namespace. Policy in the root namespace applies to workloads in all namespaces.
	RootNamespace string `json:"root_namespace"`
}

// GetAuthorizationPolicies returns the AuthorizationPolicies for the given environment.
func GetAuthorizationPolicies(env *Environment) *AuthorizationPolicies {
	policy := &AuthorizationPolicies{
		NamespaceToPolicies: map[string][]AuthorizationPolicy{},

		store.add(cfg)
	}
	environment := &Environment{
		ConfigStore: store,
		Watcher:     mesh.NewFixedWatcher(&meshconfig.MeshConfig{RootNamespace: "istio-config"}),
	}
	authzPolicies := GetAuthorizationPolicies(environment)
	return authzPolicies
}

func newConfig(name, ns string, spec config.Spec) config.Config {
	return config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.AuthorizationPolicy,

		})

		fcc := inboundChainConfig{
			clusterName: "inbound|8888||",
			port:        model.ServiceInstancePort{ServicePort: &model.Port{}},
		}
		push := cg.PushContext()
		push.AuthzPolicies = getAuthorizationPolicies()
		proxy := node(nil)
		listenerFilters := NewListenerBuilder(proxy, push).buildInboundNetworkFilters(fcc)

		RBACTCPFilterName := "envoy.filters.network.rbac"
		listenerFilterChain := &listener.FilterChain{

	store := memory.Make(collections.Pilot)
	for _, p := range policies {
		if _, err := store.Create(*p); err != nil {
			t.Fatalf("newAuthzPolicies: %v", err)
		}
	}

	authzPolicies := model.GetAuthorizationPolicies(&model.Environment{
		ConfigStore: store,
	})
	return authzPolicies
}

func push(t *testing.T, input string, mc *meshconfig.MeshConfig) *model.PushContext {
	t.Helper()
	p := &model.PushContext{

		})
	})

	t.Run("attach policy to workload", func(t *testing.T) {
		assert.EventuallyEqual(t,
			func() []string {
				return s.lookup(s.addrXdsName("127.0.0.1"))[0].GetWorkload().GetAuthorizationPolicies()
			},
			[]string{policyName},
		)
	})
}

func TestPodLifecycleWorkloadGates(t *testing.T) {
	s := newAmbientTestServer(t, "", "")

		return x.ApplicationTunnel
	}
	return nil
}

func (x *Workload) GetServices() map[string]*PortList {
	if x != nil {
		return x.Services
	}
	return nil
}

func (x *Workload) GetAuthorizationPolicies() []string {
	if x != nil {
		return x.AuthorizationPolicies
	}
	return nil
}

func (x *Workload) GetStatus() WorkloadStatus {
	if x != nil {
		return x.Status
	}

}

// pre computes all AuthorizationPolicies per namespace
func (ps *PushContext) initAuthorizationPolicies(env *Environment) {
	ps.AuthzPolicies = GetAuthorizationPolicies(env)
}

func (ps *PushContext) initTelemetry(env *Environment) {
	ps.Telemetry = getTelemetries(env)
}

func (ps *PushContext) initProxyConfigs(env *Environment) {