A NetworkPolicy has two separate ingress from entries: one with namespaceSelector team=blue, another with podSelector app=client. How are those peers combined?

1. Only the last entry is considered
2. The entire policy is invalid whenever both selector types appear
3. Either peer may allow a source; the separate entries form a union
4. Both selectors must match the same source because they are separate entries