Deny 1 route in an application with many HTTP endpoints?

[william]

Try making one HTTPRoute (and ServerAuthorization, etc) for /internal/ that denies traffic accordingly, and a second HTTPRoute (and SA, etc) for * that allows traffic. Precedence rules for HTTPRoute should apply.