// matches SubjectAccessReview status.allowed field name
		RecordAuthorizationDecision(a.authorizerType, a.authorizerName, "allowed")
	case authorizer.DecisionDeny:
		// matches SubjectAccessReview status.denied field name
		RecordAuthorizationDecision(a.authorizerType, a.authorizerName, "denied")
	default:
		RecordAuthorizationDecision(a.authorizerType, a.authorizerName, "unknown")
	}
	return decision, reason, err