Why can I use the controller from every IP

I would like to have access only from my IP, it is my function in controller:

public function behaviors()
    {
        return [
            'verbs' => [
                'class' => VerbFilter::className(),
                'actions' => [
                    'delete' => ['POST'],
                ],
            ],            
                'access' => [
                    'class' => AccessControl::className(),
                    'rules' => [
                        [
                            'allow' => true,
                            'ips' => [
                                'my IP adress',
                            ],
                        ],
                    ],
                ],

        ];
    }

Should work for the whole controller. But I can use the controller from any IP address. Why?