when:
        generateReport()

        then:
        bodyContains("First section")
        bodyContainsExact("First section 0 error")

        when:
        renderer.startNewSection("Second section")
        generateReport()

        then:
        bodyContains("First section")
        bodyContains("Second section")
        bodyContainsExact("First section 0 error")

			to := apps.A

			// First, expect to fail. Subset does not match
			_ = from.CallOrFail(t, echo.CallOptions{
				To: to,
				Port: echo.Port{
					Name: "http",
				},
				Count: 1,
				Check: check.BodyContains("no healthy upstream"),
			})

			lbls := map[string]string{"subset": "my-subset"}
			assert.NoError(t, to[0].UpdateWorkloadLabel(lbls, nil))
			t.Cleanup(func() {

			return nil
		}
		return fmt.Errorf("expected gRPC response code %q. Instead got: %w", expected.String(), err)
	}
}

// BodyContains checks that the response body contains the given string.
func BodyContains(expected string) echo.Checker {
	return Each(func(r echoClient.Response) error {
		if !strings.Contains(r.RawContent, expected) {

						exRsp.ErrorMessage, err, result.Responses)
				}
				return nil
			}
			return check.And(check.NoErrorAndStatus(exRsp.StatusCode), check.BodyContains(exRsp.ErrorMessage)).Check(result, nil)
		},
	}

								// IP=10.244.2.20
								// Alpn=
								// RequestHeader=Accept:*/*
								// RequestHeader=User-Agent:curl/7.81.0
								// Hostname=uncaptured-v1-868c9b59b5-rxvfq
								Check: check.BodyContains(`Hostname=uncaptured-v`), // can hit v1 or v2
							})
						})
				})
			}
		})
}

// Ambient ServiceEntry support for auto assigned vips is lacking for now, but planned.

								HTTP: echo.HTTP{
									Path:    c.path,
									Headers: headers.New().WithHost(c.host).WithAuthz(c.token).Build(),
								},
								Check: check.And(check.NoErrorAndStatus(wantCode), check.BodyContains(body)),
							}

							from.CallOrFail(t, opts)
						})
					}
				})
		})
}

func TestAuthz_Conditions(t *testing.T) {
	framework.NewTest(t).