Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline t

Protected branches with pull request approval manage the *source code* merge process, but they do not prevent an operator from manually building and deploying an unapproved image.

While Admission Controllers can verify requests, 'verifying that incoming requests originate from approved sources' is too generic and doesn't specifically prevent unauthorized *images* from running. Binary Authorization is the specific GCP service for this problem.

Kubernetes RBAC restricts *who* can perform actions (like `create deployment`), but it does not prevent an authorized user from deploying an *unapproved container image*. RBAC controls access to resources, not the content of those resources.

Binary Authorization is a security control that ensures only trusted container images are deployed on GKE by enforcing policies based on attestations. By configuring the build pipeline as an 'attestor' that signs images *only after* successful automated testing and approvals, Binary Authorization can prevent any image lacking the required attestation from being deployed to production.