{"record":{"id":"3ed6555f4002ca15","repo":"hashicorp/terraform","slug":"s-soft-failed-s-3ed655","errorCode":null,"errorMessage":"%s soft failed.\n%s","messagePattern":"(.+?) soft failed\\.\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_common.go","lineNumber":401,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\tswitch pc.Status {\n\t\tcase tfe.PolicyPasses:\n\t\t\tif (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {\n\t\t\t\tb.CLI.Output(\"\\n------------------------------------------------------------------------\")\n\t\t\t}\n\t\t\tcontinue\n\t\tcase tfe.PolicyErrored:\n\t\t\treturn fmt.Errorf(\"%s errored.\", msgPrefix)\n\t\tcase tfe.PolicyHardFailed:\n\t\t\treturn fmt.Errorf(\"%s hard failed.\", msgPrefix)\n\t\tcase tfe.PolicySoftFailed:\n\t\t\trunURL := fmt.Sprintf(runHeaderErr, b.Hostname, b.Organization, op.Workspace, r.ID)\n\n\t\t\tif op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||\n\t\t\t\t!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {\n\t\t\t\treturn fmt.Errorf(\"%s soft failed.\\n%s\", msgPrefix, runURL)\n\t\t\t}\n\n\t\t\tif op.AutoApprove {\n\t\t\t\tif _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {\n\t\t\t\t\treturn b.generalError(fmt.Sprintf(\"Failed to override policy check.\\n%s\", runURL), err)\n\t\t\t\t}\n\t\t\t} else if !b.input {\n\t\t\t\treturn errPolicyOverrideNeedsUIConfirmation\n\t\t\t} else {\n\t\t\t\topts := &terraform.InputOpts{\n\t\t\t\t\tId:          \"override\",\n\t\t\t\t\tQuery:       \"\\nDo you want to override the soft failed policy check?\",\n\t\t\t\t\tDescription: \"Only 'override' will be accepted to override.\",\n\t\t\t\t}\n\t\t\t\terr = b.confirm(stopCtx, op, opts, r, \"override\")\n\t\t\t\tif err != nil && err != errRunOverridden {\n\t\t\t\t\treturn fmt.Errorf(\"Failed to override: %w\\n%s\\n\", err, runURL)\n\t\t\t\t}","sourceCodeStart":383,"sourceCodeEnd":419,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend_common.go#L383-L419","documentation":"checkPolicy (backend_common.go:401) returns this for tfe.PolicySoftFailed when override is NOT possible in the current context. Soft-fail policies are overridable in principle, but the branch at backend_common.go:399-401 returns early (with the run URL) when ANY of: it's a plan operation (no override at plan time), there's no UI output, no UI input, the policy isn't IsOverridable, or the token lacks CanOverride permission. So this message means 'soft-failed AND you cannot override from here'.","triggerScenarios":"pc.Status == tfe.PolicySoftFailed AND (op.Type == OperationTypePlan OR op.UIOut == nil OR op.UIIn == nil OR !pc.Actions.IsOverridable OR !pc.Permissions.CanOverride). The run URL is appended so the user can act in the UI.","commonSituations":"Running `terraform plan` against a workspace with a soft-mandatory policy (plan-time cannot override). Running in CI/automation with no interactive UI (op.UIIn nil) so the prompt can't be shown. Token's team lacks CanOverride permission. Policy configured as soft but not flagged overridable.","solutions":["If running locally and permitted, run `terraform apply` (apply-time) where the interactive override prompt is available, and type the override keyword.","Grant the token's team the 'Can Override Soft Policy' permission in HCP/TFE.","Override the run directly in the HCP/TFE UI via the appended run URL.","If automating, use -auto-approve with a token that has override permission so PolicyChecks.Override fires automatically (backend_common.go:404-407)."],"exampleFix":"// before: CI run, no UI, soft-mandatory policy\n// -> Organization Policy Check soft failed. <run URL>\n// after: grant override permission + use -auto-approve\nterraform apply -auto-approve   # token team has CanOverride","handlingStrategy":"validation","validationCode":"// Decide override capability before the run starts.\nfunc canOverrideSoftFail(op *backendrun.Operation, pc *tfe.PolicyCheck) bool {\n    return op.Type != backendrun.OperationTypePlan &&\n        op.UIOut != nil && op.UIIn != nil &&\n        pc.Actions.IsOverridable && pc.Permissions.CanOverride\n}","typeGuard":null,"tryCatchPattern":"// On soft-fail where override isn't available, route to the UI.\nif pc.Status == tfe.PolicySoftFailed && !canOverrideSoftFail(op, pc) {\n    return fmt.Errorf(\"soft failed; override via run URL: %s\", runURL)\n}","preventionTips":["Grant the automation token's team 'Can Override Soft Policy'.","Run plan first to catch soft-fails before apply-time override.","Use -auto-approve with an override-capable token in CI."],"tags":["terraform","tfe","policy","sentinel","soft-mandatory","override","cloud-backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}