Cilium latest, v1.8 dev cycle (v1.8.0-rc1):

When enabling --policy-audit-mode, all policy verdict notifications for traffic that would otherwise be denied state action allow match none:

# cilium monitor -t policy-verdict
...
Policy verdict log: flow 0x1fdbbff4 local EP ID 1121, remote ID 16307, dst port 80, proto 6, ingress true, action allow, match L3-L4, 10.29.210.187:42768 -> 10.29.50.40:80 tcp SYN
Policy verdict log: flow 0x3cc7e88f local EP ID 343, remote ID 11862, dst port 80, proto 6, ingress true, action allow, match none, 10.29.171.240:39126 -> 10.29.47.87:80 tcp SYN

I expected it to say action deny match none. When --policy-audit-mode=false (default), the monitor verdicts will say action deny match none.

To be clear, the actual datapath forwarding behaviour is correct (policy-audit-mode allows all traffic through the policy piece), this is more about the cosmetics of the monitor messages.

To reproduce this, I followed the policy guide here to deploy the starwars app + l3/l4 policy, then sent the traffic from xwing/tiefighter pods to observe the output:
https://docs.cilium.io/en/stable/gettingstarted/http/

Initially I was surprised that this is how the policy verdicts represent the action that was chosen, but we can discuss whether it makes sense to retain the message output as-is (ie action allow match none) or to change it to action deny match none.