THE REPORT | Verified. Not Authorized.
Attestation proves a package came from a pipeline. It does not prove anyone authorized the pipeline to do what it did. Every major governance framework requires the first. None require the second. That is the gap this issue maps.
