Runs can fail after submission when the configured credentials allow access to the compute environment but the service account cannot access a private container registry. Today, that access problem may only become clear once the workflow tries to pull an image.

Please explore a preflight check that verifies access to the container registry used by a run before submission. If access is missing, show an actionable error that identifies the registry and explains what needs to be configured. Checking every image in advance may be technically difficult, so the implementation could start by validating registry access where feasible.