Admission Policy
A rule evaluated at the moment a resource is created or changed, which rejects the request rather than reporting on it afterwards.
Policy applied after the fact produces a report someone has to act on. Policy applied at admission produces a rejection with a message, at the point where the person who caused it is still looking at their terminal.
The distinction matters because the two have completely different compliance properties. A scanner that finds twelve non-compliant workloads tells you that for some window they existed; an admission rule tells you they never did. For controls where the exposure window is the risk — a public storage bucket, a container running as root, an unencrypted volume — only the second is a control.
Two practical constraints. The rule must be fast and highly available, because it is in the path of every change and a failing policy engine either blocks all deployment or is configured to fail open, which quietly removes the control. And it needs a tested exception mechanism, because the first legitimate case the rule did not anticipate will otherwise be resolved by disabling it.