Wire policy evaluation into Terraform core runtime

internal/providers/testing/provider_mock.go

@@ -676,6 +676,15 @@ func (p *MockProvider) PlanResourceChange(r providers.PlanResourceChangeRequest)
 		return resp
 	}
 
+	// this resource is deferred
+	if r.ProposedNewState.Type().HasAttribute("defer") {
+		if shouldBeDeferred := r.ProposedNewState.GetAttr("defer"); !shouldBeDeferred.IsKnown() || (!shouldBeDeferred.IsNull() && shouldBeDeferred.True()) {
+			resp.Deferred = &providers.Deferred{
+				Reason: providers.DeferredReasonResourceConfigUnknown,
+			}
+		}
+	}
+
 	schema, ok := p.getProviderSchema().ResourceTypes[r.TypeName]
 	if !ok {
 		resp.Diagnostics = resp.Diagnostics.Append(fmt.Errorf("no schema found for %q", r.TypeName))

internal/terraform/context_apply.go

@@ -12,8 +12,10 @@ import (
 	"github.com/hashicorp/terraform/internal/addrs"
 	"github.com/hashicorp/terraform/internal/collections"
 	"github.com/hashicorp/terraform/internal/configs"
+	"github.com/hashicorp/terraform/internal/depsfile"
 	"github.com/hashicorp/terraform/internal/lang"
 	"github.com/hashicorp/terraform/internal/plans"
+	"github.com/hashicorp/terraform/internal/policy"
 	"github.com/hashicorp/terraform/internal/providers"
 	"github.com/hashicorp/terraform/internal/states"
 	"github.com/hashicorp/terraform/internal/tfdiags"
@@ -46,6 +48,14 @@ type ApplyOpts struct {
 	// or test runtimes, where the root modules as Terraform sees them aren't
 	// the actual root modules.
 	AllowRootEphemeralOutputs bool
+
+	// Locks is a read-only snapshot of provider locks (from the dependency lock
+	// file).
+	Locks map[addrs.Provider]*depsfile.ProviderLock
+
+	// Optional policy client to enable live policy evaluations.
+	PolicyClient  policy.Client
+	PolicyResults *plans.PolicyResults
 }
 
 // ApplyOpts creates an [ApplyOpts] with copies of all of the elements that
@@ -61,6 +71,7 @@ func (po *PlanOpts) ApplyOpts() *ApplyOpts {
 	return &ApplyOpts{
 		ExternalProviders:         po.ExternalProviders,
 		AllowRootEphemeralOutputs: po.AllowRootEphemeralOutputs,
+		Locks:                     po.Locks,
 	}
 }
 
@@ -207,6 +218,10 @@ func (c *Context) ApplyAndEval(plan *plans.Plan, config *configs.Config, opts *A
 		PlanTimeTimestamp: plan.Timestamp,
 
 		FunctionResults: lang.NewFunctionResultsTable(plan.FunctionResults),
+
+		Locks:         opts.Locks,
+		PolicyClient:  opts.PolicyClient,
+		PolicyResults: opts.PolicyResults,
 	})
 	diags = diags.Append(walker.NonFatalDiagnostics)
 	diags = diags.Append(walkDiags)
@@ -378,6 +393,7 @@ func (c *Context) applyGraph(plan *plans.Plan, config *configs.Config, opts *App
 		Overrides:                 plan.Overrides,
 		SkipGraphValidation:       c.graphOpts.SkipGraphValidation,
 		AllowRootEphemeralOutputs: opts.AllowRootEphemeralOutputs,
+		PolicyClient:              opts.PolicyClient,
 	}).Build(addrs.RootModuleInstance)
 	diags = diags.Append(moreDiags)
 	if moreDiags.HasErrors() {