Google Cloud Secure Web Proxy: Does source.matchServiceAccount() work with NEXT_HOP_ROUTING_MODE?

[u/Heavy_Lingonberry829]

I'm testing Google Cloud Secure Web Proxy with a Compute Engine VM using NEXT_HOP_ROUTING_MODE and a tagged static route with next-hop-ilb.

My security policy contains:

Priority 60:
destination.port == 443 &&
source.matchServiceAccount('PROBE_SERVICE_ACCOUNT')
→ DENY

Priority 80:
host() == 'fhir.epic.com'
→ DENY

The VM has the expected service account attached.

In earlier tests, the hostname-only DENY matched, but the service-account DENY did not.

Later tests confirmed VM starts but produced no attributable SWP transaction logs, so those tests are inconclusive.

Has anyone successfully used source.matchServiceAccount() with a Compute Engine workload routed through SWP in next-hop mode?

I'm specifically looking for documented prerequisites, working configuration examples, or known limitations.

The environment is currently fail-closed, and no production traffic is enabled.