NetworkPolicy applied but traffic still flows between namespaces

The CNI plugin doesn't enforce NetworkPolicy (e.g., Flannel without policy support). Or the policy selector is incorrect. Test enforcement with a specific deny-all policy and verify traffic is actually blocked.