expressions: []string{"object.foo < params.x"},
			hasParams:   true,
		},
		{
			name:        "namespaceObject",
			expressions: []string{"namespaceObject.metadata.name.startsWith('test')"},
			hasParams:   true,
		},
		{
			name:             "without params",
			errorExpressions: map[string]string{"object.foo < params.x": "undeclared reference to 'params'"},
			hasParams:        false,
		},
		{

func compilePolicy(policy *Policy) Validator {
	hasParam := false
	if policy.Spec.ParamKind != nil {
		hasParam = true
	}
	strictCost := utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForVAP)
	optionalVars := cel.OptionalVariableDeclarations{HasParams: hasParam, HasAuthorizer: true, StrictCost: strictCost}
	expressionOptionalVars := cel.OptionalVariableDeclarations{HasParams: hasParam, HasAuthorizer: false, StrictCost: strictCost}

}

// OptionalVariableDeclarations declares which optional CEL variables
// are declared for an expression.
type OptionalVariableDeclarations struct {
	// HasParams specifies if the "params" variable is declared.
	// The "params" variable may still be bound to "null" when declared.
	HasParams bool
	// HasAuthorizer specifies if the "authorizer" and "authorizer.requestResource"
	// variables are declared. When declared, the authorizer variables are

				t.Fatal(err)
			}
			compiler.CompileAndStoreVariables(tc.variables, OptionalVariableDeclarations{HasParams: false, HasAuthorizer: false, StrictCost: tc.strictCostEnforcement}, environment.NewExpressions)
			validations := []ExpressionAccessor{&condition{Expression: tc.expression}}
			f := compiler.Compile(validations, OptionalVariableDeclarations{HasParams: false, HasAuthorizer: false, StrictCost: tc.strictCostEnforcement}, environment.NewExpressions)

	envs := make(variableDeclEnvs, 8) // since the number of variable combinations is small, pre-build a environment for each
	for _, hasParams := range []bool{false, true} {
		for _, hasAuthorizer := range []bool{false, true} {
			for _, strictCost := range []bool{false, true} {
				var envOpts []cel.EnvOption
				if hasParams {
					envOpts = append(envOpts, cel.Variable(ParamsVarName, cel.DynType))
				}
				if hasAuthorizer {

	ctx.variables = policy.Spec.Variables
	return ctx
}

func (c *TypeChecker) compiler(ctx *TypeCheckingContext, typeOverwrite typeOverwrite) (*plugincel.CompositedCompiler, error) {
	envSet, err := buildEnvSet(
		/* hasParams */ ctx.paramDeclType != nil,
		/* hasAuthorizer */ true,
		typeOverwrite)
	if err != nil {
		return nil, err
	}
	env, err := plugincel.NewCompositionEnv(plugincel.VariablesTypeName, envSet)
	if err != nil {

			strictCost = true
		}
		m.compiledMatcher = matchconditions.NewMatcher(compiler.Compile(
			expressions,
			cel.OptionalVariableDeclarations{
				HasParams:     false,
				HasAuthorizer: true,
				StrictCost:    strictCost,
			},
			environment.StoredExpressions,
		), m.FailurePolicy, "webhook", "admit", m.Name)
	})
	return m.compiledMatcher
}

	}
	return validateCELCondition(compiler, &validatingadmissionpolicy.ValidationCondition{
		Expression: expression,
	}, plugincel.OptionalVariableDeclarations{
		HasParams:     hasParams,
		HasAuthorizer: true,
		StrictCost:    opts.strictCostEnforcement,
	}, envType, fldPath)
}

func validateMatchConditionsExpression(expression string, opts validationOptions, fldPath *field.Path) field.ErrorList {

		t.Run(tc.name, func(t *testing.T) {
			c := filterCompiler{compiler: NewCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), true))}
			e := c.Compile(tc.validation, OptionalVariableDeclarations{HasParams: false, HasAuthorizer: false, StrictCost: true}, environment.NewExpressions)
			if e == nil {
				t.Fatalf("unexpected nil validator")
			}
			validations := tc.validation

					r := admissionregistration.FailurePolicyType("Fail")
					return &r
				}(),
				MatchConditions: []admissionregistration.MatchCondition{{
					Name:       "hasParams",
					Expression: `params.foo == "okay"`,
				}},
				Validations: []admissionregistration.Validation{{
					Expression: "object.x < 100",
				}},
			},
		},
		expectedError: "",
	}, {