Glossary
Audit policy
The kube-apiserver configuration that decides which API requests are recorded in the Kubernetes audit log and at which level of detail.
An audit policy is a YAML file of kind Policy (audit.k8s.io/v1) passed to the API server with --audit-policy-file. It holds an ordered list of rules matching users, groups, verbs, resources, namespaces or non-resource URLs; the first matching rule sets the audit level of the request. Without a policy file, a self-managed API server logs nothing. On EKS, GKE and AKS the provider sets the policy.
For investigations, the policy decides whether request bodies (privileged flags, images, roleRef) exist at all. See Kubernetes audit policy for forensics and the official auditing documentation.