selectionOpts := model.PolicyMatcherForProxy(node)
	policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
	if len(policies.Deny)+len(policies.Allow) > 0 {
		rules := buildRBAC(node, push, nameSuffix, tlsContext, rbacpb.RBAC_DENY, policies.Deny)
		if rules != nil && len(rules.Policies) > 0 {
			rbac := &rbachttp.RBAC{
				Rules: rules,
			}
			fc = append(fc,
				&hcm.HttpFilter{