out := make(echo.Instances, 0)
	for _, i := range i {
		if m(i) {
			out = append(out, i)
		}
	}
	return out
}

// GetServiceMatches returns the subset of echo.Services that match this Matcher.
func (m Matcher) GetServiceMatches(services echo.Services) echo.Services {
	out := make(echo.Services, 0)
	for _, s := range services {
		if len(s) > 0 && m(s[0]) {
			out = append(out, s)
		}
	}

			allowed := apps.Ns1.A
			denied := apps.Ns2.A

			from := allowed.Append(denied)
			fromMatch := match.AnyServiceName(from.NamespacedNames())
			toMatch := match.Not(fromMatch)
			to := toMatch.GetServiceMatches(apps.Ns1.All)
			fromAndTo := to.Instances().Append(from)

			config.New(t).
				Source(config.File("testdata/authz/mtls.yaml.tmpl")).
				Source(config.File("testdata/authz/allow-principal.yaml.tmpl").WithParams(