Function requires_privilege_resolved 

pub fn requires_privilege_resolved(
    security_context: Option<&SecurityContext>,
    pod_security_context: Option<&PodSecurityContext>,
    privileged_mode: Option<bool>,
) -> bool

Whether a mover with the given effective container security context (the explicit securityContext, or the one resolved from inheritSecurityContextFrom), pod security context, and privilegedMode is privileged. The controller resolves an inherited context to a concrete SecurityContext and gates on that — so an inherited root context is caught exactly like an explicit one — and inspects the pod-level context too so a pod-level runAsUser: 0 can’t slip past. Pure + exhaustive: the single definition of “privileged” for both the spec-only ([MoverSpec::requires_privilege]) and the resolved paths.