The conditions relied on 'is defined' and 'is not defined'. An entry which declares the unused key with an empty string - as documented in defaults/main.yaml - matched none of the four tasks, so the sudoers drop-in file was silently not created. Comparing the length of the defaulted values instead makes exactly one task apply to every entry accepted by the validation. Co-authored-by: Copilot <copilot@github.com>