he <code>source</code> section</li><li>the <code>source.principal</code> custom condition</li><li>the <code>source.namespace</code> custom condition</li></ul><p>These mTLS-only fields will never match when the traffic is plain text (non mTLS) and the request might be allowed unexpectedly.</p><p>The following is an example ALLOW policy that uses mTLS-only fields to allow requests if it is not from the namespace <code>foo</code>:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersi