No variables when looping over inventory_hostname

Just to beat this dead horse into a plowshare, you could get the effect you want (maybe?) like this:

- name: Install policies
  hosts: mgmt
  connection: httpapi
  tasks:
    - name: install-policy
      check_point.mgmt.cp_mgmt_install_policy:
        access: true
        threat_prevention: false
        policy_package: "{{ policyset }}"
        targets: "{{ item }}"
      with_inventory_hostnames:
        - all:!mgmt
      vars:
        policyset: "{{ hostvars[item].policyset }}"
      run_once: true
      when: policyset is defined

That is, use task variables to set the variable explicitly from the corresponding host’s variables — even though you are targeting one of your "mgmt" hosts. (“One of” b/c of the "run_once:" bit; you don’t want to do it across more than one I don’t think.)

2 Likes