title: Access Control for API requests is not working in WSO2 APIM 4.1.0
body: <p>I am trying <a href="https://apim.docs.wso2.com/en/latest/design/rate-limiting/access-control/" rel="nofollow noreferrer">rate limiting - allowed ip operation</a> in WSO2 APIM 4.1.0.</p>
  <p>Steps followed:</p>
  <ul>
  <li>Added new Policy by navigate to <code>Advanced Policies</code> Under the <code>Rate Limiting Policies</code> option in admin portal.</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/8HaJV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8HaJV.png" alt="added policy" /></a></p>
  <ul>
  <li>Conditional Group added by selecting Specific IP option (in below pic i just given dummy value on behalf of original ip due to security reason)</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/ancKN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ancKN.png" alt="specified ip" /></a></p>
  <ul>
  <li>Engage policy with API in publisher portal</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/N8wCc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/N8wCc.png" alt="publisher portal" /></a></p>
  <p>Problem:</p>
  <ul>
  <li><p>Set Request Count as 5, it is allowing to hit API Continuously even though rate limit exceed(more than 5 hit).</p>
  </li>
  <li><p>if i provide any invalid ip under conditional policy, still API is accessible. I think whatever ip i have provided those are only having access and rate limit applied to that IP.</p>
  </li>
  </ul>
  <p>Kindly clarify on the same..</p>