@Test
    void access_control_client_auth_cannot_be_overridden_when_disabled() {
        AthenzDomain tenantDomain = AthenzDomain.from("my-tenant-domain");
        DeployState state = new DeployState.Builder().properties(
                new TestProperties()
                        .setAthenzDomain(tenantDomain)
                        .setHostedVespa(true)
                        .allowDisableMtls(false))
                .build();

        try {
            Http http = createModelAndGetHttp(state,
                    "  <http>",
                    "    <filtering>",
                    "      <access-control tls-handshake-client-auth=\"want\"/>",
                    "    </filtering>",
                    "  </http>");
            fail("Overriding tls-handshake-client-auth allowed, but should have failed");
        } catch (IllegalArgumentException e) {
            assertEquals("Overriding 'tls-handshake-client-auth' for application is not allowed.", e.getMessage());
        }
    }
@author gjoranv
@author bjorncs
@author mortent
config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java