Shell scripts only work in JAMF Recon

First off, when a script or command is ran through a policy, it is ran as root so no need to include sudo in the command. Second, when you run "sudo jamf policy" it is checking in with the JSS and triggering the policy as if it were triggering it as a normal check-in. Are you running this command as a script payload or as a command payload?

I have the script in a policy that runs at check-in. If I force the check-in, the policy runs no problem. If I let it check-in normally, the policy fails.

My guess is the command your running requires user context, when you invoke it manually it runs with some reference to the user. When it runs on check-in it's a pure background task with no context.
Get the current user and try something like

sudo -u $Current_User sentinelctl set registration-token /Volumes/*/com.sentinelone.registration-token

You might want to wrap an if around it to make sure itonly runs when there is a current user.

Sadly, still no luck with that command.

Sorry it was just a snippet, I should have clarified you need to get the user first and then run it as the user. Something like.

Current_User=$(last -1 console | awk '/still logged in/ {print $1}')

However looking at what Sentinel One is, I'm quite surprised it needs this... Looks like some kind of security software, if it needs to be run as the user, then it probably needs it for evrery user?

test