A. Policies can only be applied to clustergroups.

B. Policies allow management and operation of the security posture of Kubernetes clusters, and other organizational objects.

C. Policies can be configured using a tag selector to restrict the scope of the policy.

D. Policies can be enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller.