Teams in one HCP Terraform organization start runs from VCS merges, from the CLI with the cloud block, and from a CI system calling the API, and every workspace uses remote execution. Security needs one set of Sentinel rules enforced on every run, whatever started it. What should the platform team do?
Select an answer to reveal the explanation.
Short Explanation
The policy set sits inside the run pipeline itself, so it doesn't care which door you used to start the run. Branch rules and pre-commit hooks only guard the VCS door, and CLI and API runs walk right past them.
Full Explanation
Policy sets are collections of policies applied to an organization globally, to specific projects, workspaces or Stacks, or to workspaces with matching tags. HCP Terraform evaluates the attached policy sets against the plan of every run in those workspaces, so enforcement does not depend on whether the run came from a VCS webhook, a CLI-driven remote run through the cloud block, or an API-created configuration version. Scoping the set globally, with exclusions if needed, also covers workspaces created later. Branch protection only governs VCS merges; CLI-driven and API-driven runs upload configuration directly without any commit to main. Running policies in one CI pipeline and asking CLI users to do the same leaves enforcement voluntary and misses runs started from the UI or other tools, and results are not recorded in the workspace's run. Pre-commit hooks run on a developer's machine, can be skipped, and never see the plan, which is the data Sentinel policies evaluate. Exam caveat: workspaces in local execution mode do not run policy enforcement, so the stated remote execution matters; mandatory enforcement levels are what make a failure stop a run. Operational check: start one run each from VCS, the CLI and the API with a deliberate violation and confirm all three stop at the policy stage with the same policy listed.