way
  action: DENY
  rules:
  - from:
    - source:
        notRequestPrincipals: [&#34;*&#34;]
</code></pre><p>Similarly, Use the following policy to require mandatory namespace isolation and also allow requests from ingress gateway.
The policy denies the request if the namespace is not <code>foo</code> and the principal is not <code>cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account</code>.
In other words, the policy allows the request only if the namespace is <code>foo</code> or the pr