Access Enforcement via Gatelet policy
This can happen in certain situations such as for API calls
The policy may not add the headers if there is no Activity set in the policy.
Under the Activities section in the policy in CloudSOC, set an activity. This will match the policy to the activity especially when the activity is started with an API call.