/td><td>&ldquo;Service&rdquo; &mdash; L7</td><td>&ldquo;Network&rdquo; &mdash; L3-4</td></tr><tr><td><strong>Implementation</strong></td><td>User space</td><td>Kernel</td></tr><tr><td><strong>Enforcement Point</strong></td><td>Pod</td><td>Node</td></tr></tbody></table><h2 id=layer>Layer</h2><p>Istio policy operates at the &ldquo;service” layer of your network application. This is Layer 7 (Application) from the perspective of the OSI model, but the de facto model of cloud native applications is that Layer 