assertTrustRootMatchesPolicy = (
  policy,
  entrypoint,
  trustRoot = DEFAULT_TRUST_ROOT_COMPARTMENT
) => {
  if (trustRoot && !isTrusted(policy)) {
    throw new TrustMismatchError(
      `Attempted to execute entrypoint ${hrPath(entrypoint)} as trusted, but policy expects an untrusted root. Either call ${hrCode('run()')} with option ${hrCode('{trustRoot: true}')} or provide a policy which trusts the root (without ${hrCode('root.usePolicy')}). Aborting`
    )
  } else if (!trustRoot && isTrusted(policy)) {
    throw new TrustMismatchError(
      `Attempted to execute entrypoint ${hrPath(entrypoint)} as untrusted, but policy expects a trusted root. Either call ${hrCode('run()')} with option ${hrCode('{trustRoot: false}')} or provide a policy which does not trust the root. Aborting`
    )
  }
}
Asserts the value of `trustRoot` matches that returned by {@link isTrusted}
when run against `policy`

@remarks
This only makes sense prior to execution.
@param {LavaMoatPolicy} policy LavaMoat policy
@param {string | URL} entrypoint Path to entry point (for error message)
@param {boolean} trustRoot Whether we plan to trust the root environment