An admission denial is this request

The error belongs to one call

When a create or update is rejected, the message names why that call was refused. It applies to the object in that request. It does not delete or re-judge objects that were already stored.

The message is text from the webhook or the built-in admission plugin that spoke. Quote it. Do not replace it with a policy name you did not see in the text.

Other objects stay where they were

A Running pod from yesterday is a different object. This denial does not say that pod is out of policy, and it does not say the namespace is empty. If you want those facts, they need their own reads.

Audit-mode reports are also a different object. A denial is not a report of every other violation.

What to write down

File the verb (create or update), the kind and name, the namespace, and the message. File the time. If a different pod is in the note, label it as a different object.

Lab: one create rejected, one pod still running

Creating pod lab-web in team-a returns an admission error: the webhook denied the request because the image tag was not pinned. Pod lab-api in the same namespace is already Running from the day before. A draft says admission failed for the namespace, so lab-api is down.

The note quotes the denial for the lab-web create and the message text. lab-api is a different object and was not this request. The namespace is not described as failed. No manifest is rewritten in the note.

request: create pod lab-web, namespace team-a
result: denied
message: image tag was not pinned
already running: pod lab-api (not this request)
write: this create was denied
not: the namespace failed, and not lab-api is down