What happens when network policies are intentionally misconfigured?

If a NetworkPolicy's podSelector is subtly wrong, matching more or fewer pods than intended, how much east-west traffic actually gets exposed, and would anything alert on it?

I expected an empty or overly broad selector to be functionally equivalent to having no policy at all, and I expected some signal (a metric, a warning, anything) when a policy matched zero pods.

A three-namespace cluster (payments, public-api, internal-tools) with Calico as the CNI. A NetworkPolicy in payments intended to allow ingress only from public-api, deployed with a label selector typo (app: paymnets-gateway instead of app: payments-gateway), the kind of mistake that ships in a rushed PR and passes review because the YAML looks correct.

I deployed the misconfigured policy, then attempted lateral connections from internal-tools (which should have been blocked) to a pod in payments, and checked three things: whether the connection succeeded, whether kubectl describe networkpolicy surfaced anything suspicious, and whether Calico's own metrics distinguished this from a correctly functioning policy.

The typo meant the policy's selector matched zero pods, which (per Kubernetes networking semantics) is different from "deny all" only if you already know to check. A policy that selects no pods enforces nothing on the pods it was meant to protect; ingress remained fully open. kubectl describe showed the policy as present and "healthy" with no warning that it was selecting nothing. Calico's metrics reported policy evaluation counts, but nothing flagged a policy with zero matched pods as an anomaly: from the metrics alone, a misconfigured policy and a correctly scoped, low-traffic policy look identical.

The dangerous version of a network policy misconfiguration isn't the one that's obviously broken. It's the one that's syntactically valid, applies cleanly, and silently protects nothing. The fix wasn't a better policy; it was an admission-time check that rejects any NetworkPolicy whose selector matches zero pods, plus a periodic job that diffs intended coverage against actual coverage. Trusting that "the policy exists" means "the policy works" turned out to be exactly the kind of assumption this publication exists to test.