} else if len(or) > 0 {
		return principalOr(or), nil
	}
	return nil, nil
}

type requestAudiencesGenerator struct{}

func (requestAudiencesGenerator) permission(key, value string, forTCP bool) (*rbacpb.Permission, error) {
	return requestPrincipalGenerator{}.permission(key, value, forTCP)
}

func (requestAudiencesGenerator) extendedPermission(key string, values []string, forTCP bool) (*rbacpb.Permission, error) {

          filter: istio_authn
          path:
          - key: request.auth.principal
          value:
            stringMatch:
              exact: foo`),
		},
		{
			name:  "requestAudiencesGenerator",
			g:     requestAudiencesGenerator{},
			key:   "request.auth.audiences",
			value: "foo",
			want: yamlPrincipal(t, `
         metadata:
          filter: istio_authn
          path:

			}
		case k == attrRequestAudiences:
			if useExtendedJwt {
				basePrincipal.appendLastExtended(requestAudiencesGenerator{}, k, when.Values, when.NotValues)
			} else {
				basePrincipal.appendLast(requestAudiencesGenerator{}, k, when.Values, when.NotValues)
			}
		case k == attrRequestPresenter:
			if useExtendedJwt {