A speculative Terraform plan in VCS succeeds but the real apply fails

A team trusts green speculative plans and later finds applies failing only when merged through the VCS trigger path.