Your company operates in a highly regulated domain.

Grant the roles/artifactregistry. writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.

Use Cloud Run to write and deploy a custom validator Enable an Eventarc trigger to perform validations when new images are uploaded.

Configure Kritis to run in your GKE clusters to enforce deploy-time security policies.

Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies