@Test
public void authorizeWorkflowActionShouldFailIfAuthorizerFails() {

  when(ac.user()).thenReturn(Optional.of(idToken));
  final ResponseException cause = new ResponseException(Response.forStatus(FORBIDDEN));
  doThrow(cause).when(authorizer).authorizeServiceAccountUsage(any(), any(), any());
  exception.expect(is(cause));
  sut.authorizeWorkflowAction(ac, WORKFLOW);
  final Try<Void> invocation = Try.run(() -> sut.authorizeWorkflowAction(ac, WORKFLOW));
  assertThat(invocation.isFailure(), is(true));
  verify(authorizer).authorizeServiceAccountUsage(
      WORKFLOW.id(), WORKFLOW.configuration().serviceAccount().orElseThrow(), idToken);
  assertThat(invocation.getCause(), is(cause));
}