Enforce it automatically, then watch for what slips through

Covers OPA Gatekeeper admission control and Falco runtime detection as complementary prevention and detection layers, plus a full Kubernetes security checklist.