Which field decides what happens when a ValidatingPolicy's expression fails?

Why this is the answer

validationActions is the enforcement switch — Deny to block, Audit to record. failurePolicy is a different failure entirely: it covers Kyverno being unavailable, not a policy that ran and said no. evaluation.mode chooses what kind of payload is judged. There is no severity field that changes enforcement; severity would only ever be metadata.