terraform plan validates syntax, resolves references and refreshes what it already manages. It does not ask the provider whether the subnet you typed exists, whether the credential can create, whether there is quota or a free host, or whether the VM will reach the internet. Those answers live in the account, so the check has to run against the account, before the apply.
Control Cloud runs that check from the app with the read-only credential that is already connected: pick the template, pick the provider, run. Recorded on a demo organization:
The six gaps, with one read-only command per provider to close each one before apply, are in the note; the full walkthrough is on the docs page.
Which of the six has bitten you with the plan in green?
