An administrator sees that a runtime audit has been generated for a container. The audit message is: “/bin/ls launche…

An administrator sees that a runtime audit has been generated for a container. The audit message is: “/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr” Which protection in the runtime rule would cause this audit?