What most clearly distinguishes Kyverno's policy model from OPA Gatekeeper's?

Why this is the answer

Both engines gate admission; the difference is how a rule is written. Kyverno uses CEL within Kubernetes custom resources, while Gatekeeper compiles Rego supplied through ConstraintTemplates. Neither runs inside the API server — both are external webhooks it calls. Neither enforces at the container runtime; that is the job of tools like Falco. And Kyverno keeps policies as cluster resources precisely so git and kubectl remain the interface.