A service mesh auth policy trusts a namespace label that is added only after pod admission during a failover rehearsal

The policy is correct in the steady state while admission-time decisions happen before the required metadata exists. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.