validate_image_platform can dereference image even when the image couldn't be found/pulled. In the ImageNotFound/NotFound and APIError branches, the function only prints an error and continues, leaving image as None and then accessing image.attrs (will raise at runtime). After failing to get/pull the image, return/raise (or call sys.exit(1)) before computing detected, and ensure the APIError branch also exits on failure.

AciPolicy.__init__ uses an assert to enforce that all images share the same platform. Asserts can be stripped with Python optimizations and they surface as an AssertionError rather than a user-friendly CLI error. Please replace this with explicit validation that raises a proper CLI/validation error (or calls eprint + exits) with actionable guidance.

_add_rego_boilerplate now has Linux/Windows branches but falls through without returning anything if _platform is neither (returns None). Even if the CLI currently restricts choices, it’s safer to explicitly raise ValueError/eprint+exit for unsupported platforms so callers don’t later fail with confusing TypeErrors.

ContainerImage.from_json accesses container_json["platform"], which will raise KeyError for older input.json/policy files that don’t include this field. To preserve backward compatibility, use container_json.get("platform", "linux/amd64") (or infer from policy) instead of requiring the key.

The reStructuredText heading underline for 2.0.0b1 is shorter than the heading text, which can render incorrectly in RST. Please adjust the underline length to match the version string (consistent with other entries like 1.8.0).