A policy author has written a new Sentinel policy that blocks public storage buckets. Before it can stop anyone's run, the author wants evidence that it passes compliant plans and fails non-compliant ones, and then wants to watch its behavior on real runs for a week. What is the recommended approach?

HCP Terraform can generate Sentinel mock data from an existing run, either with the Download Sentinel mocks button on the plan or through the plan export API. The mock bundle contains tfplan, tfconfig, tfstate and tfrun mocks that the Sentinel CLI uses, and sentinel test runs each policy against pass and fail test cases that reference those mocks, giving repeatable evidence of both outcomes before deployment. Attaching the policy at the advisory level then shows its result on every real run without interrupting anyone, and the author raises it to soft- or hard-mandatory once the results are trusted. Enforcing it as hard-mandatory on production first uses live delivery as the test environment and blocks legitimate changes whenever the rule is wrong. The Terraform test framework exercises Terraform modules; its expect_failures argument targets checkable objects such as variable validations and custom conditions, not Sentinel policies. Terraform validate checks configuration syntax and internal consistency and has no knowledge of Sentinel. Exam caveat: generated mocks can contain sensitive values from the configuration, plan and state, so treat them carefully and prefer mocks from non-sensitive runs. Operational check: run sentinel test in CI on every policy pull request and confirm each policy has at least one passing and one failing case.