# Official sources

Use this reference only when you need source grounding for GCP Artifact Registry and supply chain security service behavior or the detailed source list.

## Google Cloud documentation

Use these as starting points, not as proof of the user's live GCP state:
- https://cloud.google.com/artifact-registry/docs/overview
- https://cloud.google.com/binary-authorization/docs/overview
- https://cloud.google.com/container-analysis/docs/container-analysis
- https://cloud.google.com/artifact-registry/docs/repositories/cleanup-policy
- https://cloud.google.com/artifact-registry/docs/access-control
- https://cloud.google.com/binary-authorization/docs/policy-yaml-reference
- https://cloud.google.com/artifact-registry/docs/cmek

## Grounding rule

Official documentation explains GCP Artifact Registry and Binary Authorization service behavior. It does not prove the user's current IAM bindings, attestor configuration, or vulnerability scan coverage. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.
