ASM detecting but not blocking the attack

Hey Guys, I'm currently dealing with the same behaviour. I'm running 11.4 and staging is disabled. I am trying to lock down an ASM policy so that only certain URLs are made public. I do see the URLs being registered as illegal in event logging, but we are still able to access them through the device. This is happening in my manual, and automatic policies. In the uatomatic policy, I see that access to these URLs ends up in the "violations on URLs" category. Since illegal URL isn't really a signature, I should be able to simply block this by adding it to the disallowed URL category, right?