Why Kubernetes policy enforcement happens too late—and what to do about it

Kubernetes policy enforcement tools like OPA, Kyverno, and Conftest typically operate at CI/CD pipelines and admission controllers — but by then, developers have lost context and remediation is costly. The post introduces the concept of an 'enforcement locus' and argues for adding a review-time enforcement layer: surfacing policy violations as inline annotations directly within pull requests, client-side, without CI or cluster access. This complements rather than replaces existing tooling, forming a defense-in-depth governance model. The post also explores how AI agents could extend this further — explaining violations in context, generating fix suggestions, and enabling natural language policy authoring — making governance faster, more collaborative, and more developer-friendly.