using sourceLabel in istio is not working

I am trying to filter access to external ressources. I have created a service entry

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: bbc-ext
spec:
  hosts:
  - "*.bbc.co.uk"
  ports:
  - number: 443
    name: https
    protocol: HTTPS

I am using sourceLabel to filter the source app allowed to access external ressources.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bbc-ext
spec:
  hosts:
  - "*.bbc.co.uk"
  http:
  - match:
    - sourceLabels:
        envir: "production"
    route:
    - destination:
        host: "*.bbc.co.uk"
      weight: 100
  - route:
    - destination:
        host: "*.bbc.co.uk"
    fault:
      abort:
        percent: 100
        httpStatus: 400

My pod is labeled envir=development but is still allowed access to the ressource.

kubectl get pods --show-labels
NAME                    READY     STATUS    RESTARTS   AGE       LABELS
sleep-d7bfccf65-ws6t6   2/2       Running   0          16m       app=sleep,envir=development,pod-template-hash=836977921

But, when I log in the container and run a curl request it is still valid. What am I doing wrong here?

kubectl exec -it sleep-d7bfccf65-ws6t6  -c sleep bash
root@sleep-d7bfccf65-ws6t6:/# curl -v -sL https://www.bbc.co.uk -w "%{http_code}\n"    -o /dev/null
 [...]
< Cache-Control: private, max-age=0, must-revalidate
< Vary: Accept-Encoding, X-CDN, X-BBC-Edge-Scheme
<
{ [data not shown]
* Connection #0 to host www.bbc.co.uk left intact
200