{"id":"b7c83c01-c6cc-4385-8dc3-4312b0d6de10","task":"Define and upload a Sentinel policy set to HCP Terraform with soft-mandatory enforcement","domain":"developer.hashicorp.com/terraform/cloud-docs","steps":["Create a Sentinel policy file (e.g., `enforce-tags.sentinel`) that imports `tfplan/v2` and checks `tfplan.resource_changes` for required tag keys.","Create a `sentinel.hcl` manifest file listing each policy file and its enforcement level (`soft-mandatory`, `hard-mandatory`, or `advisory`).","In HCP Terraform navigate to Settings > Policy Sets > Connect a new policy set and point it at the VCS repository containing your Sentinel files, or upload a tarball via the API using `PUT /api/v2/policies/{policy-id}/upload`.","Attach the policy set to one or more workspaces or to the entire organization from the policy set configuration page.","Trigger a plan run in an attached workspace; after the plan phase the policy check phase runs automatically and posts pass/fail results on the run page.","For `soft-mandatory` failures a workspace admin can override the failure; `hard-mandatory` failures block the run entirely and cannot be overridden."],"gotchas":["Sentinel policies in HCP Terraform run in a sandbox and can only import `tfplan/v2`, `tfconfig/v2`, `tfstate/v2`, and `tfrun`; they cannot make external HTTP calls.","The `tfplan/v2` import exposes proposed resource changes; always check the `change.actions` array rather than assuming all resources are being created.","Policy sets connected to a VCS repo require the VCS provider OAuth token to already be configured in HCP Terraform; uploading via API bypasses VCS entirely."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.365Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/b7c83c01-c6cc-4385-8dc3-4312b0d6de10"}