What causes "overridden using the UI or API" in hashicorp/terraform?

No action required — the CLI recognizes the external override and continues.

overridden using the UI or API

Error message

overridden using the UI or API

What it means

Sentinel error produced by the remote backend confirm() loop during soft-policy override prompting. When the polled run leaves the tfe.RunPolicyOverride status and is not discarded, the run was overridden via the UI/API, so the CLI skips its own PolicyChecks.Override call.

Source

Thrown at internal/backend/remote/backend_common.go:30

	"math"
	"strconv"
	"strings"
	"time"

	tfe "github.com/hashicorp/go-tfe"

	"github.com/hashicorp/terraform/internal/backend/backendrun"
	"github.com/hashicorp/terraform/internal/logging"
	"github.com/hashicorp/terraform/internal/plans"
	"github.com/hashicorp/terraform/internal/terraform"
)

var (
	errApplyDiscarded   = errors.New("Apply discarded.")
	errDestroyDiscarded = errors.New("Destroy discarded.")
	errRunApproved      = errors.New("approved using the UI or API")
	errRunDiscarded     = errors.New("discarded using the UI or API")
	errRunOverridden    = errors.New("overridden using the UI or API")
)

var (
	backoffMin = 1000.0
	backoffMax = 3000.0

	runPollInterval = 3 * time.Second
)

// backoff will perform exponential backoff based on the iteration and
// limited by the provided min and max (in milliseconds) durations.
func backoff(min, max float64, iter int) time.Duration {
	backoff := math.Pow(2, float64(iter)/5) * min
	if backoff > max {
		backoff = max
	}
	return time.Duration(backoff) * time.Millisecond
}

View on GitHub (pinned to c9def3e214)

Solutions

No action required — the CLI recognizes the external override and continues.
Review the policy override audit log if the override was not intended.
Restrict who can override policies via workspace/team permissions to prevent surprise overrides.

Defensive patterns

Strategy: try-catch

Try / catch

if err := b.confirm(ctx, op, opts, run, "override"); err != nil && !errors.Is(err, errRunOverridden) {
    return fmt.Errorf("Failed to override: %w", err)
}
// errRunOverridden means it was overridden via UI/API — skip local PolicyChecks.Override

Prevention

Restrict policy-override permissions to a known set of teams.
Log policy overrides centrally so out-of-band overrides are auditable.
Treat errRunOverridden as success-equivalent control flow.

When it happens

Trigger: A soft-failed policy check prompts for override ('override' keyword) and, while the CLI waits, the override is performed in the TFE/HCP UI or via POST /policy-checks/{id}/override.

Common situations: A security/compliance team member overrides a policy from the UI while the operator is reviewing; an automated policy-override bot acts first.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/655b9b5c8901c6e0. Report an issue: GitHub.