Country access Control behind CDN

Hi,
We have been experiencing some problems with one of our setups with the Country Access control. Our main Kaltura servers are behind our CDN and the Blocking service doesn’t work well 100% of the time.

We cache some API calls and have implemented different cache rules (including origin country, for instance) but still doesn’t work.

I would like to know better when or where the acl is applied. We thought it is when the player is loaded but haven’t completely figured it out in order to adjust our cache/cdn.

Any help will be appreciated,

David Eusse