A new Sentinel rule requiring encryption on all storage resources would fail for many existing workspaces if enforced today. The governance team wants the rule live in every workspace without breaking teams on day one, and to block violations later. What rollout should it use?
Select an answer to reveal the explanation.
Short Explanation
Think of a new speed camera that sends warning letters for the first month before it starts issuing tickets. Advisory shows everyone where they stand, and then you raise the enforcement level once teams have caught up.
Full Explanation
Sentinel policies in HCP Terraform have three enforcement levels: advisory, soft-mandatory and hard-mandatory. An advisory failure never interrupts a run but is reported in the run's policy results, so attaching the new rule at advisory exposes every non-compliant workspace on its next run without blocking anyone. The governance team can use those results to drive fixes, then raise the level to soft-mandatory, where failures stop the run unless an authorized user overrides them, and finally to hard-mandatory once the estate is compliant. Starting at hard-mandatory and enabling overrides on the policy set lets authorized users override even hard-mandatory failures for every policy in that set, so the override path becomes routine and weakens the other policies there. Waiting until teams self-certify compliance provides no data, because nobody can see violations until the rule runs, and the switch to hard-mandatory would still break whoever was missed. Granting override rights to every user turns soft-mandatory into a speed bump that people learn to click through, and it scales poorly because each run still pauses. Exam caveat: OPA policies offer only advisory and mandatory, so the same staged approach moves from advisory straight to mandatory. Operational check: after each step, review the explorer or run results for failing workspaces and confirm the count falls before raising enforcement.