The development team wants to fail CI jobs where a specific CVE is contained within the image. How should the development team configure the pipeline or policy to produce this outcome?

Magic strings in the Console are not a valid mechanism for setting CVE-specific exceptions in the CI scanning workflow.

The CI policy in Prisma Cloud Console is the authoritative location where CVE exceptions are defined - setting a specific CVE there controls whether that CVE causes a build failure or is exempted, ensuring the rule is applied consistently across all pipeline scans. This centralized approach means every Jenkins job or twistcli invocation respects the same exception configuration without requiring per-pipeline changes.

Defender executes the scan but does not own policy configuration - CVE exception logic is managed centrally in Console, not on the Defender performing the scan.

Jenkins and twistcli are scan execution tools that invoke the policy defined in Console and do not independently manage CVE exception configuration.