{"record":{"id":"c5b87a51bc5f6ec4","repo":"hashicorp/terraform","slug":"s-hard-failed-c5b87a","errorCode":null,"errorMessage":"%s hard failed.","messagePattern":"(.+?) hard failed\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/backend_common.go","lineNumber":395,"sourceCode":"\t\t\t\t\tline = append(line, l...)\n\t\t\t\t}\n\n\t\t\t\tif next || len(line) > 0 {\n\t\t\t\t\tb.CLI.Output(b.Colorize().Color(string(line)))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tswitch pc.Status {\n\t\tcase tfe.PolicyPasses:\n\t\t\tif (r.HasChanges && op.Type == backendrun.OperationTypeApply || i < len(r.PolicyChecks)-1) && b.CLI != nil {\n\t\t\t\tb.CLI.Output(\"\\n------------------------------------------------------------------------\")\n\t\t\t}\n\t\t\tcontinue\n\t\tcase tfe.PolicyErrored:\n\t\t\treturn fmt.Errorf(\"%s errored.\", msgPrefix)\n\t\tcase tfe.PolicyHardFailed:\n\t\t\treturn fmt.Errorf(\"%s hard failed.\", msgPrefix)\n\t\tcase tfe.PolicySoftFailed:\n\t\t\trunURL := fmt.Sprintf(runHeaderErr, b.Hostname, b.Organization, op.Workspace, r.ID)\n\n\t\t\tif op.Type == backendrun.OperationTypePlan || op.UIOut == nil || op.UIIn == nil ||\n\t\t\t\t!pc.Actions.IsOverridable || !pc.Permissions.CanOverride {\n\t\t\t\treturn fmt.Errorf(\"%s soft failed.\\n%s\", msgPrefix, runURL)\n\t\t\t}\n\n\t\t\tif op.AutoApprove {\n\t\t\t\tif _, err = b.client.PolicyChecks.Override(stopCtx, pc.ID); err != nil {\n\t\t\t\t\treturn b.generalError(fmt.Sprintf(\"Failed to override policy check.\\n%s\", runURL), err)\n\t\t\t\t}\n\t\t\t} else if !b.input {\n\t\t\t\treturn errPolicyOverrideNeedsUIConfirmation\n\t\t\t} else {\n\t\t\t\topts := &terraform.InputOpts{\n\t\t\t\t\tId:          \"override\",\n\t\t\t\t\tQuery:       \"\\nDo you want to override the soft failed policy check?\",","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/backend_common.go#L377-L413","documentation":"checkPolicy (backend_common.go:394-395) returns this for tfe.PolicyHardFailed. A 'hard failed' policy is a severe failure (e.g. the policy framework could not enforce a mandatory policy at all) that cannot be overridden and blocks the run unconditionally.","triggerScenarios":"pc.Status == tfe.PolicyHardFailed in the switch at backend_common.go:386. Distinct from PolicySoftFailed (overridable) and PolicyErrored (runtime crash); hard-fail typically means a mandatory/advisory enforcement level was applied and a hard enforcement policy was violated or the enforcement itself broke.","commonSituations":"A hard-mandatory Sentinel policy was violated and cannot be overridden. Policy service misconfigured to hard-fail. Org governance rule that intentionally blocks.","solutions":["Read the streamed policy logs to identify which hard-mandatory rule failed and why.","Bring the plan into compliance with the hard-mandatory policy (there is no override path).","If the policy is wrong, an admin must modify the policy set's enforcement level in HCP/TFE.","Re-run after the configuration satisfies the policy."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Identify hard-mandatory policies up front so plans are compliant by design.\nfunc hasHardMandatory(policySets []tfe.PolicySet) []string {\n    var names []string\n    for _, ps := range policySets {\n        if ps.EnforcementLevel == \"hard-mandatory\" { names = append(names, ps.Name) }\n    }\n    return names\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat hard-mandatory policies as build-breaking; satisfy them in config before pushing.","Review enforcement levels with policy owners before raising severity.","Document hard-mandatory rules for all teams touching the workspace."],"tags":["terraform","tfe","policy","sentinel","hard-mandatory","cloud-backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}