Istio (1.6.2) : DENY policy in Authorization Policy does not work with Valid Token

I’m new to Istio. I’m implementing Authorization with JWT. The DENY action is not reflected for a valid JWT token. I’ve added the JWT Payload and Authorization Policy for reference. I’m using kubernetes version v1.18.3 and Istio 1.6.2. I’m running cluster on minikube.

I applied below rule on ingressgateway first:

apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: ingress-auth-jwt
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "https://dev-n63ipah2.us.auth0.com/"
    jwksUri: "https://dev-n63ipah2.us.auth0.com/.well-known/jwks.json"
    audiences: 
    - "http://10.97.72.213/"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: ingress-authz
 namespace: istio-system
spec:
 selector:
   matchLabels:
     istio: ingressgateway
 action: ALLOW
 rules:
  - when:
    - key: request.auth.claims[iss]
      values: ["https://dev-n63ipah2.us.auth0.com/"]

After that I applied below policy for dex-ms-contact service

JWT Payload:
{
  "iss": "https://dev-n63ipah2.us.auth0.com/",
  "sub": "sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0@clients",
  "aud": "http://10.97.72.213/",
  "iat": 1594274641,
  "exp": 1594361041,
  "azp": "sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0",
  "gty": "client-credentials"
}

RequestAuthentication:

apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: dex-ms-contact-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: dex-ms-contact
  jwtRules:
  - issuer: "https://dev-n63ipah2.us.auth0.com/"
    jwksUri: "https://dev-n63ipah2.us.auth0.com/.well-known/jwks.json"
    audiences: 
    - "http://10.97.72.213/"
---
apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: dex-ms-contact-require-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: dex-ms-contact
  action: DENY
  rules:
  - when:
    - key: request.auth.claims[iss]
      values: ["https://dev-n63ipah2.us.auth0.com/"]

The ingressgateway policy works fine. However when I apply DENY policy on a dex-ms-contact service The DENY policy does not reflect with a valid JWT token. Ideally it should not allow me to access dex-ms-contact service right?

What is the expected behavior?