The image is built and signed by the same pipeline as any application, so a run can only execute what was reviewed. The run itself is a claim that Clearance narrows and Crossplane renders.
Principle honored
Supply chain first: agent code is untrusted code. Images are signed by Glidepath (cosign, self-hosted Fulcio and Rekor) and referenced by digest, never by tag.
What changes
Admission verifies the signature (Kyverno verifyImages is already in the cluster).
Third-party agent images take the same path, and default to the hardened sandbox class where the cluster has one.
A run whose image is not on the signed path is rejected, not warned about.
Verify live
Try to run an unsigned image, and a tag instead of a digest. The XRD schema refuses the tag; admission has to refuse the unsigned image. Test the second one, not just the first.