A guardrail constrains system behavior without removing team control. In platform engineering, teams retain ownership of their pipelines while compliance and security checks verify changes at deployment. section 4.1.1
This pattern separates doing compliance work from verifying it. Kubernetes admission controllers intercept deployments and run validating webhooks before a change reaches an environment, including production. section 4.1.1
Deployment label validation
A Gatekeeper-based admission controller checks whether a deployment has the required labels before allowing it to proceed. section 4.1.1
Figure 4.3 Kubernetes admission controller
Trace how a Kubernetes admission controller intercepts deployment changes for validation. section 4.1.1
