}
	if len(r.To) == 0 {
		m.permissions = append(m.permissions, basePermission)
	}

	return &m, nil
}

// MigrateTrustDomain replaces the trust domain in source principal based on the trust domain aliases information.
func (m *Model) MigrateTrustDomain(tdBundle trustdomain.Bundle) {
	for _, p := range m.principals {
		for _, r := range p.rules {
			if r.key == attrSrcPrincipal {

				"td-2/ns/foo/sa/sleep",
			},
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got, err := New(tc.rule, false)
			if err != nil {
				t.Fatal(err)
			}
			got.MigrateTrustDomain(tc.tdBundle)
			gotStr := spew.Sdump(got)
			for _, want := range tc.want {
				if !strings.Contains(gotStr, want) {
					t.Errorf("got %s but not found %s", gotStr, want)
				}
			}

			}
			m, err := authzmodel.New(rule, b.option.UseExtendedJwt)
			if err != nil {
				b.logger.AppendError(multierror.Prefix(err, fmt.Sprintf("skipped invalid rule %s:", name)))
				continue
			}
			m.MigrateTrustDomain(b.trustDomainBundle)
			if len(b.trustDomainBundle.TrustDomains) > 1 {
				b.logger.AppendDebugf("patched source principal with trust domain aliases %v", b.trustDomainBundle.TrustDomains)
			}