Status: IN
ImageStream access follows a controlled model: images are immutable and content-addressed, end users access them via ImageStreamTag/ImageStreamImage (not Image directly), pulling requires explicit get-layers permission, and ImageStreamMapping is restricted to privileged integrators.
Four beliefs collectively enforce a layered access control model over image content
Depends on (SL): image-objects-immutable-content-addressed, end-users-access-images-via-imagestreamtag-or-imagestreamimage, imagestream-pull-requires-get-layers-permission, ocp-imagestreammapping-privileged-only