Workload Readiness Rules
Lookup material for the seven registration readiness rules, R1 to R7. For how the verdict works, see Registration readiness. To fix a failing rule, see Make a workload ready to register.
Workload Trust is available only in private, self-managed AIControls installations, on premises or in a cloud cluster that you run. It needs a dedicated cluster that you run, with Kyverno, Kyverno Runtime, and cluster OIDC and RBAC access in place. Nirmata-hosted (SaaS) workspaces don't include it. See Feature availability.
How the rules combine
Each rule returns Pass, Fail, or Unknown. An unknown rule never passes: evidence that AIControls couldn't read, or that is stale or incomplete, is a reason to review the workload.
| Verdict | When |
|---|---|
| Ready to register | Every rule passes. A registered workload reads Meets readiness rules. |
| Fix N issues | At least one rule fails, where N is the number of failing rules. A failure wins over an unknown rule. |
| Review | Nothing fails, but at least one rule is unknown. |
The verdict is advisory. It never registers a workload, changes a protection status, or enables enforcement.
The rules
| ID | Rule | Passes when | Fails when | Unknown when | Evidence source |
|---|---|---|---|---|---|
| R1 | Pod security | The pod template meets the Restricted level. If an administrator accepts Baseline, Baseline also passes. | The level is Baseline (and Baseline isn't accepted) or Privileged. | Discovery hasn't evaluated the pod template, or the level isn't recognized. | The Pod Security level discovery computes from the pod template. |
| R2 | Least-privilege RBAC | The ServiceAccount has no Kubernetes API access (none) or read-only access (read), with no high-privilege capability and no wildcard rule. | The access is write or cluster-admin, or the ServiceAccount has a high-privilege capability, or a granting rule uses * for its verbs, resources, or API groups. | The workload posture access is off, the RBAC read failed, or the value is stale because its source is failing. | The rbac-privilege signal of the stored deployment risk band. |
| R3 | No direct internet egress | A default-deny egress NetworkPolicy covers the namespace. | The namespace has no NetworkPolicy, or none of its policies denies egress by default. | The NetworkPolicy read is unavailable or stale. | The network-exposure signal of the stored risk band. |
| R4 | Kyverno policies | Every Kyverno policy that counts under the policy selection passes. | Any counted policy reports fail, warn, or error. | Kyverno isn't installed or can't be read, its policies or reports are unavailable, a selected policy that applies hasn't reported yet, no policy has reported on the workload, every result was skipped, a result value isn't recognized, or the newest result is more than 24 hours old. | The Kyverno policy reports for the workload. |
| R5 | RuntimePolicy | No RuntimePolicy exists yet (AIControls generates one at registration), or the RuntimePolicy compiled and declares file open and exec limits. | The RuntimePolicy failed to compile, declares nothing to compile, or compiled without file open or exec limits. | The protection record or registration can't be read, the workload is registered but its policy isn't generated yet, or the status isn't recognized. | The workload's registration and the compiled policy on its protection record. |
| R6 | Traffic through the proxy | AIControls verified LLM, MCP, or TLS traffic through the proxy over a complete traffic history, and no plane bypassed it. | AIControls observed LLM, MCP, or TLS traffic that bypassed the proxy. | Routing evidence can't be read, the traffic history is incomplete, or no traffic has been observed. | The workload's traffic routing evidence. |
| R7 | One workload identity | AIControls observed no multiple or shared identity for the workload. | AIControls observed the workload calling with two or more identities at the same time, or another workload using the same identity. | The identity findings can't be read. | The multiple-identities and shared-identity findings for the workload. |
Rule details
R1: Pod security
The default bar is Restricted. An administrator can accept Baseline instead: on the Workloads page, select Readiness settings and set Accepted Pod Security level to Baseline. Only administrators can change it, and each change is recorded in the configuration audit log. The setting applies to every workload in the deployment. A Privileged pod template fails at either setting.
A failing R1 lists each failing check with the pod spec change that fixes it.
R3: No direct internet egress
R3 checks only for a default-deny egress NetworkPolicy. AIControls doesn't verify that your cluster's network plugin enforces NetworkPolicies. A proxy bypass that AIControls observes is reported once, under R6.
R4: Kyverno policies
Which policies count comes from the Kyverno policy selection in Settings → Workloads. Under All policies, every policy that reports on the workload counts. Under Selected policies, only the selected policies count, and each selected policy that applies to the workload must have reported, or R4 is Unknown. If no counted policy has reported, R4 is Unknown. A failing policy fails R4 even when other Kyverno evidence is incomplete. Passing evidence older than 24 hours is stale, and stale evidence is Unknown, matching the Posture tab.
R5: RuntimePolicy
A missing RuntimePolicy never blocks Ready to register, because registering a workload against a Blueprint generates one from the Blueprint's Runtime Binding. After registration, the policy must compile and declare both file open and exec limits.
R6: Traffic through the proxy
R6 is the only rule that reports a proxy bypass. If the traffic history doesn't cover the whole window, a verified call can't prove proxy-only routing, so R6 reads Unknown unless it saw a bypass.
R7: One workload identity
R7 checks for one workload identity. The owning team is a registration requirement, not a readiness rule: the registration wizard asks for it.