<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-transactions-authorizationpolicy
  namespace: default
spec:
  selector:
    matchLabels:
      app: transactions
  action: ALLOW
  rules:
  - from:
    - source:
        principals: [&quot;cluster.local/ns/default/checking-account&quot;]
    to:
    - operation:
       methods: [&quot;GET&quot;]
       paths: [&quot;/*&quot;]
</code></pre>
<p>it denies checking-account to access transaction workload.</p>
<p>If I change action to DENY. it allows checking-account to access transaction workload.</p>
<p>Can someone help me why allow is denying and deny is allowing?</p>

srikant
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-transactions-authorizationpolicy
  namespace: default
spec:
  selector:
    matchLabels:
      app: transactions
  action: DENY
  rules:
  - from:
    - source:
        principals: [&quot;cluster.local/ns/default/checking-account&quot;]
  - to:
    - operation:
       methods: [&quot;GET&quot;]
       paths: [&quot;/*&quot;]
</code></pre>
<p>I needed to put <strong>-</strong> in front of <strong>to:</strong></p>
<p>That fixed the issue.</p>
