func TestAuthz_WorkloadSelector(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			// Verify that the workload-specific path (/policy-<ns>-<svc>) works only on the selected workload.
			t.NewSubTestf("single workload").
				Run(func(t framework.TestContext) {
					from := apps.Ns1.A
					fromMatch := match.ServiceName(from.NamespacedName())
					toMatch := match.Not(fromMatch)