in general we accept file system r/w access to the system custodian runs on to already be effectively game over, ie its not part of the threat model. a bad policy (delete all compute) is already sufficient to cause issues.

some of this was discussed already in the threat model assesment we did with cncf sig security a few years back which has an extensive write up.

ditto for passing controlling the config file on the chart, as it can be used to specify policy repos and subscriptions already, ie its already trusted content.

sent via email as well if you want to followup