STRICT</code> but want to make sure the traffic is indeed protected by mTLS with
an extra check in the authorization layer, i.e., defense in depth.</p><p>The following policy denies the request if the principal is empty. The principal will be empty if plain text is used.
In other words, the policy allows requests if the principal is non-empty.
<code>"*"</code> means non-empty match and using with <code>notPrincipals</code> means matching on empty principal.</p><pre><code class=language-yaml data-expandlinks