Ansible - Define 'failed_when' on a per item basis

I've been migrating my IAM deployment with FreeIPA to the freeipa.ansible_freeipa collection which worked fine for the most part. I've encountered a false-positive failure when using external groups / external members which will be pulled in using a trust. Here are three posible outcomes:

• Case 1:
  The external group is not already a member in which case the ipagroup module will search for, try to add it and return a 'changed' state if it was successful
• Case 2:
  The external group is already a member in which case the ipagroup module will return a 'failed' with a message of 'trusted domain object is already a member' which is the false positive
• Case 3:
  The external group is not already a member in which case the ipagroup module will search for, try to add it and return a 'failed' state if it was unsuccessful
  

I will focus on case number two for this post.

I'm starting with this task in my playbook which behaves exactly as described above:

 - name: configure external groups in ipa  
   loop: "{{ ipa_externalgroup }}"  
   freeipa.ansible_freeipa.ipagroup:  
     cn: "{{ item.name }}"  
     state: "{{ item.state }}"  
     description: "{{ item.description if item.description is defined else omit }}"  
     external: true  
     externalmember: "{{ item.groups | default('') }}"  
     ipaadmin_principal: "{{ ipa.user }}"  
     ipaadmin_password: "{{ ipa.pass }}"  
   tags:  
     - groups  

Now since this will fail due to false positives, here's my proposal to fix it using onboard tools

 - name: configure external groups in ipa  
   loop: "{{ ipa_externalgroup }}"  
   freeipa.ansible_freeipa.ipagroup:  
     cn: "{{ item.name }}"  
     state: "{{ item.state }}"  
     description: "{{ item.description if item.description is defined else omit }}"  
     external: true  
     externalmember: "{{ item.groups | default('') }}"  
     ipaadmin_principal: "{{ ipa.user }}"  
     ipaadmin_password: "{{ ipa.pass }}"  
   register: result  
   failed_when: "result['msg'] is defined and 'trusted domain object not found' in result['msg']"  
   tags:  
     - groups  

Making the 'register' and 'failed_when' modifications will only make the task fail if the object cannot be found in the trusted domain and pass the 'trusted domain object is already a member' as okay to you.

Feel free to comment and / or suggest a topic.