>In the trace result, you should find the following custom tags indicating the request is rejected by the dry-run policy
<code>deny-path-headers</code> in the namespace <code>foo</code>:</p><pre><code class=language-plain data-expandlinks=true data-repo=istio>istio.authorization.dry_run.deny_policy.name: ns[foo]-policy[deny-path-headers]-rule[0]
istio.authorization.dry_run.deny_policy.result: denied
</code></pre></li><li><p>The following is a screenshot of the Zipkin dashboard:</p><figure style=width:100%><