You need every service's pipeline to run a security scan, a license check, and require signed artifacts before deploy. How do you enforce that across a hundred repositories without ending up with a hundred slightly different pipeline files?
Ship the gates as a shared, versioned pipeline template that repositories include rather than copy, so an update to the check propagates everywhere at once and drift is visible instead of silent. Use this ci cd answer to show the decision, trade-off, and evidence rather than a memorised definition. It also connects compliance to the point an interviewer is testing.