While troubleshooting an issue related to rate limiting, I noticed the following in the istio-policy logs.

2019-10-03T19:33:01.815126Z error istio.io/istio/pkg/kube/secretcontroller/secretcontroller.go:148: Failed to list *v1.Secret: secrets is forbidden: User "system:serviceaccount:user1-smcp:istio-mixer-service-account" cannot list resource "secrets" in API group "" in the namespace "istio-system"

This is on a system with the control plane deployed to the namespace `user1-smcp`. Note that there is an istio-system namespace, but there's nothing in it.