ctAccessReviewSpec"XSpec holds information about the request being evaluated.  user and groups must be empty
§