{"record":{"id":"7397cc94ccdb7ff3","repo":"hashicorp/terraform","slug":"s-soft-failed-s","errorCode":null,"errorMessage":"%s soft failed.\n%s","messagePattern":"(.+?) soft failed\\.\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote/backend_common.go","lineNumber":451,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\tswitch pc.Status {\n\t\tcase tfe.PolicyPasses:\n\t\t\tif (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {\n\t\t\t\tb.CLI.Output(\"\\n------------------------------------------------------------------------\")\n\t\t\t}\n\t\t\tcontinue\n\t\tcase tfe.PolicyErrored:\n\t\t\treturn fmt.Errorf(\"%s errored.\", msgPrefix)\n\t\tcase tfe.PolicyHardFailed:\n\t\t\treturn fmt.Errorf(\"%s hard failed.\", msgPrefix)\n\t\tcase tfe.PolicySoftFailed:\n\t\t\trunURL := fmt.Sprintf(runHeaderErr, b.hostname, b.organization, op.Workspace, r.ID)\n\n\t\t\tif op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||\n\t\t\t\t!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {\n\t\t\t\treturn fmt.Errorf(\"%s soft failed.\\n%s\", msgPrefix, runURL)\n\t\t\t}\n\n\t\t\tif op.AutoApprove {\n\t\t\t\tif _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {\n\t\t\t\t\treturn generalError(fmt.Sprintf(\"Failed to override policy check.\\n%s\", runURL), err)\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\topts := &terraform.InputOpts{\n\t\t\t\t\tId:          \"override\",\n\t\t\t\t\tQuery:       \"\\nDo you want to override the soft failed policy check?\",\n\t\t\t\t\tDescription: \"Only 'override' will be accepted to override.\",\n\t\t\t\t}\n\t\t\t\terr = b.confirm(stopCtx, op, opts, r, \"override\")\n\t\t\t\tif err != nil && err != errRunOverridden {\n\t\t\t\t\treturn fmt.Errorf(\"Failed to override: %w\\n%s\\n\", err, runURL)\n\t\t\t\t}\n\n\t\t\t\tif err != errRunOverridden {","sourceCodeStart":433,"sourceCodeEnd":469,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote/backend_common.go#L433-L469","documentation":"In checkPolicy(), when pc.Status == tfe.PolicySoftFailed AND the run cannot be overridden in the current context: it's a plan operation, or there is no interactive UI (UIIn/UIOut nil), or the policy check is not overridable (pc.Actions.IsOverridable false) or the token lacks override permission (pc.Permissions.CanOverride false). A soft failure is overridable in principle, but not from this code path, so it surfaces as an error with a run URL.","triggerScenarios":"A soft-mandatory policy fails during: a `plan` (op.Type == OperationTypePlan, no override offered for plans), a non-interactive run (no terminal/UIIn), or when the policy/token disallows override. The user is given the run URL to act in the UI.","commonSituations":"Running `terraform plan` remotely where a soft policy fails (plans never prompt to override); running in CI with no interactive UI so the override prompt can't appear; the token's team lacks 'Override soft policy' permission.","solutions":["Follow the run URL in the message to override (or discard) the soft failure in the HCP/TFE UI.","Fix the configuration to satisfy the policy so no override is needed.","Grant the token's team the 'Override Soft Policy' permission AND run apply (not plan) interactively so the override prompt appears next time.","Use `terraform apply -auto-approve` which takes the auto-override branch (line 454) if permissions allow."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Only attempt override path when permissions + apply context allow it.\nfunc canOverrideHere(op *backendrun.Operation, pc *tfe.PolicyCheck) bool {\n    return op.Type != backendrun.OperationTypePlan &&\n        op.UIIn != nil && op.UIOut != nil &&\n        pc.Actions.IsOverridable && pc.Permissions.CanOverride\n}","typeGuard":"func isSoftFailed(s tfe.PolicyStatus) bool {\n    return s == tfe.PolicySoftFailed\n}","tryCatchPattern":"if err := b.checkPolicy(stopCtx, cancelCtx, op, r); err != nil {\n    if strings.Contains(err.Error(), \"soft failed\") {\n        // direct user to the run URL in the message to override via UI\n    }\n    return err\n}","preventionTips":["Grant the token's team 'Override Soft Policy' permission if overrides are expected.","Don't rely on plan-time override prompts — plans never offer override; use apply.","Fix soft-policy violations in config when possible to avoid needing override.","Run interactively (with UIIn/UIOut) so the override prompt can appear."],"tags":["policy","run","sentinel","soft-mandatory","permissions"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}