A cluster must run only images signed by an approved build identity. What control should evaluate the signature before admitting a workload?

1. Only a readiness probe after the container starts
2. Only a registry name substring check
3. Only a ConfigMap listing the phrase signed images
4. An admission integration that verifies signatures against the trusted identity policy