When running part 4 of the verification in https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/installing/ossm-istio-ambient-mode#ossm-adding-authorization-policy_ossm-istio-ambient-mode, the returned code is 405 instead of the expected 403. This means that the endpoint is rejected by the application and not by the authorization policy of the waypoint.

The curl pod is created in the default namespace which is not part of the mesh. The waypoint is bypassed. By adding the default namespace in the mesh with

kubectl label namespace default istio.io/dataplane-mode=ambient 

The authorization is enforced and the verification returns the expected 403 code.