Some application work sits outside a single Pod manifest. Helm manages versioned packages as releases; Kustomize composes plain resource bases and overlays. A custom resource definition adds an API schema, while a controller must still implement the resource's reconciliation behavior. Authentication identifies a caller, authorization permits an operation and admission can reject a proposed write after authorization. Those boundaries require different repairs. The local terminal doesn't execute package managers or a production authorization chain. Instead, these checked planning tasks give you explicit evidence and ask for one concrete decision token. The explanations connect that decision to the official platform concepts without inventing an external action.