createPeerAuthentication(s, "policy1", "ns", &v1beta1.PeerAuthentication{})
	expectAddedAndRemoved(ads.ExpectResponse(), []string{"istio-system/istio_converted_static_strict"}, nil)

	createPeerAuthentication(s, "policy2", "ns", &v1beta1.PeerAuthentication{
		Mtls: &v1beta1.PeerAuthentication_MutualTLS{
			Mode: v1beta1.PeerAuthentication_MutualTLS_PERMISSIVE,
		},

	"istio.io/istio/pkg/config/schema/kind"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/util/sets"
	"istio.io/istio/pkg/workloadapi/security"
)

const (
	staticStrictPolicyName = "istio_converted_static_strict" // use '_' character since those are illegal in k8s names
)

func (a *index) Policies(requested sets.Set[model.ConfigKey]) []model.WorkloadAuthorization {
	// TODO: use many Gets instead of List?

const (
	xdsConvertedPeerAuthSelector       = "converted_peer_authentication_selector"
	xdsConvertedPeerAuthSelectorStrict = "converted_peer_authentication_selector-strict"
	xdsConvertedStaticStrict           = "istio_converted_static_strict"
	xdsGlobal                          = "global"
	xdsGlobalSelector                  = "global-selector"
	xdsNamespace                       = "namespace"
	xdsSelector                        = "selector"
)