HashiCorp Sentinel is a policy-as-code framework built into HashiCorp’s commercial products, including HCP Terraform and Terraform Enterprise. Sentinel policies run between terraform plan and terraform apply, and can block an apply that violates a rule, such as an unapproved instance type or missing tags.
Sentinel uses its own policy language and supports enforcement levels: advisory, soft-mandatory (can be overridden) and hard-mandatory. Because it runs inside HashiCorp’s platform, it applies only to Terraform runs managed there.
Teams that use other execution platforms, or that govern Ansible and Terraform together, often check code earlier, at commit and in CI/CD. Steampunk Spotter does that for both languages before code reaches the execution platform.
