private static void verifyPolicyRules(Investigation i, List<PolicyRule> testRules)
      throws Throwable {
    List<AccessRights> rights = tbclient.readPolicy(i.getResourceURL());
    List<PolicyRule> rules = new ArrayList<PolicyRule>();
    for (AccessRights right : rights) {
      rules.addAll(right.getRules());
    }

    for (PolicyRule testRule : testRules) {
      PolicyRule matchingRule = null;
      for (PolicyRule rule : rules) {
        fillInSubject(rule);
        IToxBankResource subject = rule.getSubject();
        TestCase.assertNotNull("PolicyRule subject is null", subject.getResourceURL());
        IToxBankResource testSubject = testRule.getSubject();
        if (subject.getResourceURL().equals(testSubject.getResourceURL())) {
          TestCase.assertEquals(
              "Should have same get for " + testSubject.getResourceURL(),
              testRule.allowsGET(),
              rule.allowsGET());
          TestCase.assertEquals(
              "Should have same put for " + testSubject.getResourceURL(),
              testRule.allowsPUT(),
              rule.allowsPUT());
          TestCase.assertEquals(
              "Should have same post for " + testSubject.getResourceURL(),
              testRule.allowsPUT(),
              rule.allowsPOST());
          TestCase.assertEquals(
              "Should have same delete for " + testSubject.getResourceURL(),
              testRule.allowsPUT(),
              rule.allowsDELETE());
          matchingRule = rule;
        }
      }
      if (matchingRule == null) {
        TestCase.fail("Did not have a rule for: " + testRule.getSubject().getResourceURL());
      } else {
        rules.remove(matchingRule);
      }
    }

    if (rules.size() > 0) {
      StringBuilder sb = new StringBuilder();
      for (PolicyRule rule : rules) {
        sb.append(rule.getSubject().getResourceURL());
        sb.append("\n");
      }
      TestCase.fail("Had extraneous rules: " + rules.size() + "\n  " + sb.toString());
    }
  }