An image reaches production that no pipeline built
A pipeline builds images tagged `service:latest`; the deployment references that tag. The registry accepts pushes from three service accounts and four humans. A scanner reports 340 findings, all acknowledged. During a routine audit, someone finds that the running digest does not match any pipeline run from the last month.
The fix that looks right
Responding to the 340 findings by enabling a policy that blocks any image with a critical or high severity finding. The dashboard turns green within a week — not because the vulnerabilities were fixed, but because teams learned to add suppressions to get their deploys through, and the suppression file is now the real policy. The security posture is measurably worse than before, because previously the findings were visible and unactioned, and now they are invisible and unactioned. A policy people cannot satisfy becomes a policy people route around, and the route around it is always less visible than the problem was.