A namespace should reject privileged containers under a standard workload baseline. Which mechanism can enforce this at admission?

1. A larger Service cluster IP range
2. A ConfigMap describing recommended behavior only
3. Pod Security Admission with an appropriate enforce policy
4. An image pull policy of Always alone