package kubernetes.admission deny[msg] { msg := "this is not allowed" }