Why can I use the controller from every IP

I would like to have access only from my IP, it is my function in controller:

public function behaviors()
    {
        return [
            'verbs' => [
                'class' => VerbFilter::className(),
                'actions' => [
                    'delete' => ['POST'],
                ],
            ],            
                'access' => [
                    'class' => AccessControl::className(),
                    'rules' => [
                        [
                            'allow' => true,
                            'ips' => [
                                'my IP adress',
                            ],
                        ],
                    ],
                ],

        ];
    }

Should work for the whole controller. But I can use the controller from any IP address. Why?

Looks wrong. It should work with the config in question unless I’m missing something. Can you reproduce it with clean basic application template?