Baffled by Ontap 8 Clustered Mode NFS Export Policies

I am baffed by the ue of export polcies. I have an NFS volume exported as follows:

netapp-clr01::> vserver export-policy rule show -policyname templates -vserver netapp-nfs01
             Policy          Rule    Access   Client                RO
Vserver      Name            Index   Protocol Match                 Rule
------------ --------------- ------  -------- --------------------- ---------
netapp-nfs01 templates       1       nfs      10.0.0.0/8            any


netapp-clr01::> vserver export-policy rule show -policyname templates -vserver netapp-nfs01  -ruleindex 1

                                    Vserver: netapp-nfs01
                                Policy Name: templates
                                 Rule Index: 1
                            Access Protocol: nfs
Client Match Hostname, IP Address, Netgroup, or Domain: 10.0.0.0/8
                             RO Access Rule: sys
                             RW Access Rule: sys
User ID To Which Anonymous Users Are Mapped: 65534
                   Superuser Security Types: any
               Honor SetUID Bits in SETATTR: true
                  Allow Creation of Devices: true

netapp-clr01::> volume show -volume templates -fields policy vserver volume policy
------------ --------- ---------
netapp-nfs01 templates templates

Yet all clients are denied: 

netapp-clr01::> vserver export-policy check-access -vserver netapp-nfs01 -volume templates -authentication-method sys -protocol nfs3 -access-type read -client-ip 10.2.48.1 -policy templates
There are no entries matching your query.

netapp-clr01::> vserver export-policy check-access -vserver netapp-nfs01 -volume templates -authentication-method sys -protocol nfs3 -access-type read -client-ip 10.2.48.1
 Policy Policy Rule
Path Policy Owner Owner Type Index Access
----------------------------- ---------- --------- ---------- ------ ----------
/ default netapp_nfs01_root
 volume 0 denied

Showmount -e looks OK:

~$ showmount -e 10.2.48.102
Exports list on 10.2.48.102:
/                                   Everyone

What am I missing here?