# RBAC retrieval and boundary verification

The learner wrote the NetworkPolicy and namespace-scoped RBAC solution from memory, without consulting documentation. In the live lab, the `report-reader` ServiceAccount can get and list ConfigMaps but cannot create ConfigMaps or read Secrets, demonstrating correct least-privilege scope and verification discipline.

## Evidence

Live `kubectl auth can-i` results: `yes`, `yes`, `no`, `no` for the required four permissions.