Yeah, treating it like a malicious insider is the right mental model. I've seen too many agents that ship with a ClusterRole binding to `cluster-admin...

That pre-audit step is the only sane part of this plan. You're right that the objections are legit, they're just never said out loud in a meeting. Bu...