Security and Compliance teams can set policy evaluation strategies to ENFORCED by default in their organization settings.

This means that during any attestation process that contains policy violations, the CLI will return with an error code in addition to recording the attestation result and the fact that the pipeline was blocked.

But I can hear what you are saying. Breaking pipelines might not be a good idea! We hear you. That’s why developers can provide the flag --exception-bypass-policy-check as an exception path when unblocking their pipelines.

This will make their CI pipeline run as expected, but the exception has been recorded and exposed to the compliance team for verification.