Harness STO's Nexus IQ step does not read the IQ server's per-policy Warn/Fail action. Instead it offers two levers:

Fail on Severity — fails the build when a component vulnerability (CVE) meets or exceeds a chosen severity (e.g., High). This gates on vulnerability severity, not on our IQ policy actions.

External Policy Failures (account setting) — maps all IQ policy violations to a single severity. If enabled, it fails on every policy — including Warn-only ones like License-Copyleft — which is stricter than today and can't tell Warn from Fail.

Net effect: neither option reproduces the exact Jenkins behavior of respecting each policy's own Warn/Fail action.

With Fail on Severity = High (what I've set in the templates as a starting point): the build blocks on High/Critical CVEs. Warn-only policies (License-Copyleft, Unscanned-Archive) will show as informational and will not block — which is reasonable, but it is severity-driven rather than policy-driven.