A good starting point for reading is https://cloud.google.com/security/binary-authorization-for-b... . It also links out to other whitepapers covering different dimensions of the problem.