Which resources can be added in scope while creating a vulnerability policy for continuous integration?

Clusters are a runtime compute resource and are not a valid scope dimension for CI-focused vulnerability policies, which target build-time artifacts.

CI vulnerability policies in Prisma Cloud are scoped to container images, and labels are used as metadata selectors to refine which images fall within the policy's scope. Images are the primary artifact scanned during CI pipelines, and labels allow teams to target specific image groups - such as by environment, team, or application - without enumerating individual image names. This combination provides both the resource type and the filtering mechanism needed for precise CI policy scoping.

Containers are running instances and are scoped in runtime policies, not in CI vulnerability policies that target images before deployment.

AccountID is used for scoping cloud account-level policies, not for CI vulnerability policies, which operate at the image and label level.