How should runtime detection and response be designed for production in Container Security?

Baseline expected behavior, alert on high-confidence deviations, correlate with Kubernetes identity, and define containment runbooks. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.