This article explains that Okta's Access Policy rules, which use the AND User is filter set to Assigned the app and a member of one of the following, do not apply to the Client Credentials grant type (used by API Service Apps), because this flow operates without a user context.

• Custom Authorization Servers 
• Access Policies
• API Service Apps
• Client Credentials Flow

Okta Access Policy rules with an AND User is filter set to Assigned the app and a member of one of the following are not triggered during Client Credentials Flow. This flow is designed for machine-to-machine communication and, therefore, operates without an end-user context. Since there is no user associated with the request, any Access Rule that requires a specific user will not be met and, consequently, will not be applied.

To ensure the Access Policy rule is evaluated, set the AND User is filter to Any user assigned the app.