Suppose if I don't subscribe to Pulumi Business Critical plan, does it mean the policy check will be done locally for which the

--policy-pack <path-to-policy-pack-directory>

has to be supplied in the pulumi up command? In this case, seems like anyone can just alter the policies in the directory and then get their changes applied? Secondly, it seems that the Github Actions for Pulumi doesn't support policy-pack option yet, which means the policy won't be able to be enforced if the workflow is executed via Github Actions?

@microscopic-cpu-38113 yes, for local policies that is the case. server side policies don't have that issue. Could you file an issue for the action use case? We can add that feature if you need