# Validating Admission Policy retrieval

The learner completed Lesson 31 after iterative correction. They can now explain that a ValidatingAdmissionPolicy CEL expression returns `true` to admit a request, use `all()` to evaluate every regular and init container, guard optional fields with `has()`, combine compliance checks with short-circuit logic, and scope `Deny` enforcement through a ValidatingAdmissionPolicyBinding namespace selector.

## Evidence

The final manifest passes static review and includes a helpful denial message. Runtime admission outcomes remain unverified because `kubectl` was unavailable in the teaching shell.

## Retrieval target

Revisit CEL list macros and optional-field guards later without stepwise prompting. Continue reporting the complete issue list while correcting only one issue per review round.