policy-controller
OPA, Kyverno and Sigstore policy-controller rules that admit signed AI-agent execution evidence against a consumer-pinned policy.