The image shows network access control within an OCI tenancywith a VCN using Zero Trust Packet Routing policy. An authorized user connects through a DRG, into a virtual cloud network labeled Net1. The VCN hosts three resources: two application servers named App-1 and App-2, and a database labeled DB-1, and a compute instance named Compute-1.

In the OCI Tenancy, a policy is configured to allow App-1 to connect to the database:

In networks:Net1 VCN allow apps:App-1 to connect to apps:DB-1

The diagram shows the policyt being enforced in the tenancy with a successful allowed connection from App-1 to the database, indicated by a check mark. Connections from App-2 to the database and from Compute-1 to the database are denied, each indicated by an X mark.