A hotfix run in a production HCP Terraform workspace stops because a Sentinel policy set to soft-mandatory fails. Security has reviewed the change and approved it as a one-time exception. What lets the run proceed while keeping the policy in place?
Select an answer to reveal the explanation.
Short Explanation
A soft-mandatory policy is a locked gate with a key, and only people holding the override permission carry that key. You don't tear the gate down (switching to advisory) and you don't sneak around it with -target. You let the right person unlock it once.
Full Explanation
A failed soft-mandatory Sentinel policy stops the run in a policy override state. Organization administrators decide who may override such failures, either all members or specific teams, through the Manage Policy Overrides permission. An authorized user overrides the failure for that single run, the run proceeds to apply, and the policy stays enforced for every later run, which is exactly a reviewed one-time exception. Treating soft-mandatory as a warning describes advisory enforcement; an advisory failure never pauses a run, but a soft-mandatory failure does, and plain apply permission is not enough to continue. Temporarily changing the policy to advisory weakens enforcement for every workspace the set governs during that window and leaves no per-run record of the exception. Resource targeting does not narrow policy evaluation; the policy still evaluates the plan, and targeting is an exceptional recovery tool rather than a governance bypass. Exam caveat: hard-mandatory failures cannot be overridden unless the policy set is explicitly configured to allow overrides, which is a deliberate set-level choice. Operational check: confirm the approving engineer's team has the policy override permission, override the failed check on the run page, and verify the run history records who performed the override.