Developers complain that a Sentinel policy only reports the main rule as false, so they cannot tell which resource broke it or why, and each fix reveals another failure on the next run. What change to the policy addresses this?
Select an answer to reveal the explanation.
Short Explanation
A good policy failure reads like a parking ticket: which car, which spot, what rule. Loop over everything, print each offender's address and value, and you can fix every problem in one pass instead of playing whack-a-mole.
Full Explanation
Sentinel rules return true or false, and a bare result tells a developer nothing about which resource failed. HashiCorp's guidance for Terraform policies is to collect resources into a map keyed by their full address, then use a for loop outside the rules to check every instance, printing the address, the offending value and what was expected for each violation, and returning whether all passed. Sentinel's all and any expressions short-circuit, so a rule built from them stops at the first failure and reports one violation at a time, which is exactly the fix-rerun-fail cycle described. Printing every violation in one evaluation lets developers fix all problems after a single policy check, and the address format matches plan output so they can find the resource immediately. The OPA equivalent builds a deny set of messages with sprintf that include the resource address. Changing enforcement to advisory only stops the failure from blocking; it adds no detail about the cause. Rule names are identifiers in the result tree, not per-resource messages, so lengthening them still leaves developers guessing. Exam caveat: also print when an attribute is computed and cannot be checked at plan time, so developers understand why a value was skipped. Operational check: introduce two violations in a test workspace and confirm one run lists both resource addresses with their offending values.