if err := checkDryRunAnnotation(config, isAuthz); err != nil {
			return nil, err
		}
		if _, f := config.Annotations[constants.AlwaysReject]; f {
			return nil, fmt.Errorf("%q annotation found, rejecting", constants.AlwaysReject)
		}
		return f(config)
	}
}

func checkDryRunAnnotation(cfg config.Config, allowed bool) error {