A NetworkPolicy selects the Pods it governs and declares permitted ingress or egress. The destination selector and allowed source selector are different parts of the rule. A policy that selects the wrong application can be valid while leaving the intended workload unprotected. Namespace boundaries also matter: a Pod selector in a source rule has a specific scope unless combined with namespace selection. Production enforcement requires a network plugin that implements these policies. The local tasks inspect the declaration and its stated traffic intent. You'll permit a fictional frontend role to reach one application port, retaining an explicit boundary around the selected destination.