# SecurityContext placement retrieval

The learner completed Lesson 33 and explicitly preferred its manifest-hardening format. The final static manifest correctly separates Pod-wide identity and seccomp settings from container-level privilege escalation, capabilities, and read-only-root controls. It also confines the sidecar's writable state to an `emptyDir` mount.

## Coaching adjustment

Increase subsequent work to original, timed, multi-control tasks aligned with the public CKS curriculum or harder. Preserve exam-style brevity, require verification evidence, and continue listing all issues while correcting one per review round.

## Evidence limitation

The manifest passed static review. Runtime rollout and filesystem verification were not observed in the teaching shell.