@Test
public void test_isValidPolicyItem_failures() {

	// empty access collections are invalid
	RangerPolicyItem policyItem = mock(RangerPolicyItem.class);
	when(policyItem.getAccesses()).thenReturn(null);
	_failures.clear(); Assert.assertFalse(_validator.isValidPolicyItem(policyItem, _failures, _serviceDef));
	_utils.checkFailureForMissingValue(_failures, "policy item accesses");
	List<RangerPolicyItemAccess> accesses = new ArrayList<>();
	when(policyItem.getAccesses()).thenReturn(accesses);
	_failures.clear(); Assert.assertFalse(_validator.isValidPolicyItem(policyItem, _failures, _serviceDef));
	_utils.checkFailureForMissingValue(_failures, "policy item accesses");
	
	// both user and groups can't be null
	RangerPolicyItemAccess access = mock(RangerPolicyItemAccess.class);
	accesses.add(access);
	when(policyItem.getUsers()).thenReturn(null);
	when(policyItem.getGroups()).thenReturn(new ArrayList<String>());
	_failures.clear(); Assert.assertFalse(_validator.isValidPolicyItem(policyItem, _failures, _serviceDef));
	_utils.checkFailureForMissingValue(_failures, "policy item users/user-groups/roles");
}