One of the following:

In some cases, Security policy rules listed in the Review Policy Rules Blocking Sanctioned or Tolerated GenAI Apps recommendation might include Security policy rules blocking access to Sanctioned and Tolerated GenAI apps even though traffic for those apps was already allowed.

For example, you create Allow-Rule that allows traffic to Sanctioned-App1 and Tolerated-App2. You order Allow-Rule at the top of your Security policy rulebase so traffic to these allowed GenAI apps is evaluated first.

You also create Deny-Rule using an application filter to block traffic to all other GenAI apps not explicitly allowed by your organization. This application filter dynamically groups all GenAI apps so it includes Sanctioned-App1 and Tolerated-App2. You place this Security policy rule at the bottom of your Security policy rulebase so it's evaluated last.

In this case, the Review Policy Rules Blocking Sanctioned or Tolerated GenAI Apps recommendation lists Deny-Rule as blocking access to your Sanctioned and Tolerated GenAI apps even though traffic to these apps was already evaluated against Allow-Rule and allowed.