How do I get our sales team to stop expensing fancy dinners as 'client meetings' without proof?

This is an infrastructure drift problem. Your sales team is provisioning unauthorized resources (fancy dinners) and tagging them incorrectly, which breaks your financial state reconciliation.

You need to enforce policy at the point of "apply," not just during "plan" or audit. Here's how I'd architect the controls:

* **Define clear modules:** Create a standardized, approved expense "module" with required inputs. No proof, no reimbursement.
```hcl
module "client_meal_expense" {
source = "./modules/expense/approved-client-meal"

amount = var.amount
date = var.date
client_name = var.client_name
attendees = var.attendees # Must list client attendees
receipt_uri = var.receipt_uri # Link to uploaded receipt in your system
business_justification = var.justification

# Validation rules inside the module will fail if these are null/malformed
}
```
* **Policy as Code:** Use a tool like OPA/Conftest or your expense platform's rules engine to validate *before* submission. Example policy checks:
* "client_meal" category requires a `client_name` and `attendees` field.
* Amounts over a threshold require pre-approval ID.
* Receipt image must be present and uploaded within 24 hours of the date.
* **State Locking:** The finance team should hold the "lock" on reimbursement. No expense is paid (`terraform apply`) until the state file (report) matches the policy. The receipt and attendee list are the `required_providers`.
* **Drift Detection:** Regular audit scans (weekly `terraform plan`) for flagged categories. Any "client meeting" expense without proper tags gets flagged for immediate destruction (reimbursement clawback).

The key is making the process declarative. They declare the client, attendees, and receipt. If they can't fill those fields, the "module" won't run. It removes subjectivity.

Are you using a system that allows for custom mandatory fields and validation rules? If not, you're trying to solve a policy problem with a PDF form, which is never going to work.