Set up tag governance

Define the tag taxonomy that drives allocation, coverage, and most cost insights, then drive your estate to compliant.

1. Declare the taxonomy (Dictionary)

Go to Tagging → Dictionary. This is the cockpit for the tag dictionary:

• Recommended catalog — nine seeded templates (application, project, environment, squad, cost_center, criticality, lifecycle, repository, revision). Click Add tag / Add N value(s) to adopt one. This is the fast, non-AI way to a starter taxonomy.
• Dictionary — the authoritative list. For each tag key set:
  • value mode: free_text or allowed_values,
  • enforcement level: inform → audit → append → deny,
  • required or optional.
• Tags & values in use — the live observed inventory. Values that don’t match an allowed_values definition are flagged unrecognized in red; filter to just those to plan a normalisation campaign.

Tag matching is case- and separator-insensitive — cost-center, cost_center, and Cost Center collapse to one key; prod, PRD, and Production collapse to one canonical value via aliases.

Tip

Tighten enforcement only after the dictionary reflects reality, or you’ll flood your coverage numbers with false violations.

System-derived _system.* tags (Azure RG/subscription, AWS account, GCP project) are emitted automatically at ingest — useful for MSP per-tenant pivots even before you author anything. On Tagging → System tags you can promote a system key into the formal taxonomy.

2. Find the gaps and apply tags (Studio)

Go to Tagging → Studio. The header badge shows your overall tag coverage %, with a chip per required tag below 100% — your gap list at a glance.

1. Filter the estate by cloud, resource type, free text, or an existing tag = value. Tag Studio is cross-cloud: Azure and AWS resources can be in the same selection.
2. Multi-select the resources to fix (the selection persists across pages).
3. Pick an operation (Set value or Remove key) and a tag key/value.
4. Click Stage change to queue the changes in the Staging workbench — or Copy CLI to get the exact az tag (Azure) or AWS tagging CLI right away. leancosts never writes tags itself.
5. (Optional) Save as change request to log the change to the dual-control ledger for an audit trail.

normalizable (right value, wrong spelling) counts toward coverage as auto-fixable, so the headline percent is “compliant or one alias away”.

3. Review and preview staged changes (Staging)

Go to Tagging → Staging to manage changes you’ve staged before running them.

• Filter the staged queue by cloud, type, operation (set / remove), or tag predicates.
• Select a subset and click Get CLI for these to copy the exact provider commands for just those resources.
• Switch /costs to Planned (the toggle in the page header) to see what your cost allocation by tag will look like once the changes land — staged cells appear with a diagonal hatch and an “incl. $X staged” label. Grand totals never change (only re-attribution across tag values).
• After running the CLI in your cloud shell, click Mark applied. The next connector sync will automatically dissolve staged rows whose real tags now match, keeping the queue clean.

Why it matters downstream

Coverage and the canonical tag map feed allocation rules, cost-by-tag pivots, and hunter scoping. Good tags upstream make every other surface trustworthy.