Review an AI worker’s supplementary groups beyond Pod declarations

Start with the identity set the worker actually needs

A fictional AI preprocessing worker needs an independently approved primary group G-P, an additional collaboration group G-E and a separately reviewed volume group G-V. Its admitted image also describes membership in G-I, which the job does not need. A reviewer comparing only the visible Pod fields can miss that fourth role.

Use these symbolic labels solely to discuss a group plan. They are not numeric credentials, a manifest or an inspected account mapping. Select one ordinary Linux Pod/container running a fixed, independently trusted image and worker. The decision is whether the proposed membership inventory is complete and appropriate before an operation receives authority.

The workload-creation guide owns Secret and ServiceAccount paths. The ACL guide owns a different selected access branch. Neither substitutes for this process-group inventory, and this inventory supplies no file-access result.

Separate three declarations from image membership

Kubernetes’ security-context task describes runAsGroup as the primary group, with fsGroup and supplementalGroups adding group membership. Default Merge also includes memberships from the primary user’s image /etc/group. Strict limits supplementary membership to the documented fsGroup, supplementalGroups and runAsGroup fields, excluding that implicit image contribution.

Record primary, additional and volume-related roles in separate worksheet columns. A label appearing in more than one role is not evidence that those roles are interchangeable. Preserve the intended role and its justification even when a displayed membership list repeats the primary group.

For the paper proposal, G-I is an unresolved extra until independently excluded from the effective plan or separately admitted for a justified purpose. Do not turn its presence into an invented claim that a particular host account, tenant or file is reachable. That requires evidence outside this worksheet.

Require support evidence rather than a policy label

The same task’s support section documents runtime/node support and distinguishes unsupported-node behavior: the v1.31–v1.32 alpha could silently fall back to Merge; since v1.33 beta the kubelet rejects such Strict Pods. The page labels the feature beta and enabled by default since v1.33.

Consequently, keep requested policy, effective supported profile and observed outcome as separate receipt fields. An unavailable or rejected worker cannot become a successful explicit-only worker. A historical behavior example cannot be silently applied to another version. The selected positive requires independently established support for the actual node/runtime/profile, not merely an accepted-looking proposal.

The observed documentation has v1.37 navigation and a July 28, 2026 modification date. Those identify the source, not an installed cluster. No node, runtime, feature gate, image or policy was inspected here; all remain unknown for a real decision.

Use an original membership admission sheet

The conditional positive admits only the fixed membership plan: every role is necessary, the selected supported policy excludes the unneeded implicit G-I contribution, and independently established effective evidence matches the approved roles for the intended worker. Every other prerequisite in the sheet must also hold.

This is useful before granting access because it makes the extra-membership question explicit. It neither starts a worker nor authorizes a read. If the evidence lacks any required association, hold the positive rather than completing the sheet from an image name, policy label or plausible list.

Do not stretch an initial identity observation across time

The documented status identity concerns the first attached identity of the first container process; sufficiently privileged processes can later change identity. Treat that observation as scoped evidence, not a lifetime credential guarantee.

Our stricter application policy requires an independently established relationship between the admitted job, the relevant process and the operation’s identity interval. A startup receipt alone leaves that relationship incomplete when later behavior is unknown. The application must also resolve actual group mappings and any authority outside ordinary membership before drawing an object-access conclusion.

This guide implements none of that observation or enforcement. It does not drop groups, change permissions, inspect credentials or decide an ACL branch. The existing exec-transition boundary remains a separate contract.

Walk eight inert admission cards

Keep the prelaunch assurance narrow

Actual runtime support, full image/group inventory, effective policy, worker association, identity lifetime, mappings, privilege envelope, resource controls and current data rights are unimplemented or unknown. They block a real positive. This worksheet offers no sandbox, universal credential restriction or permission-repair recipe.

No manifest, Pod, cluster, group, credential, permission, node observation, CLI, API, runtime fixture or model operation was constructed or executed. Ordinary editorial file handling is separate. Boundary is prelaunch with planned request-path checks; its existing synthetic policy evidence does not demonstrate this Kubernetes membership control.