Resource Tags

A tag is a key and value pair on a resource, such as environment=development on an agent. Use tags to group resources, show who owns them, attribute cost, and select resources in policies that support tags.

A tag is only a label. It does not enforce anything until a policy uses it.

Try one tag

1. Open a test agent in Agents and select the Tags tab.
2. Make sure that the tags are managed manually. If a manifest declares them, change the manifest instead.
3. Add the key environment with the value development, and save.
4. Reload the tab. The agent shows environment=development.

To make a policy act on the tag, configure that policy separately and test it.

Limits and validation

Rule	Limit
Tags on one resource	50 user-managed tags
Key length	1 to 128 bytes
Value length	1 to 256 bytes
Keys	Each key once per resource. Verdictan trims spaces around keys and values.
Reserved prefix	Keys that start with verdictan: belong to Verdictan.

Verdictan sorts tags by key, so the order that you send has no meaning. Limits count UTF-8 bytes, and a non-ASCII character uses more than one byte.

Where tags show

You can tag agents, gateways, configurations, provider keys, tokens, teams, roles, policies, and members from their detail pages in the Console. Some History sessions and Trail events also have tags. Use the Tags tab of the resource or its Manage tags action.

Manual and declarative ownership

Each tag set has one management source:

Source	Where you edit it
Manual	The Tags tab in the Console, or the tag API
Declarative	The control manifest or configuration that owns the resource. The Console shows these tags as read-only.

To change declarative tags, change the manifest and apply it. A direct API write to those tags causes drift.

Add tags in the Console

1. Open the detail page of the resource.
2. Select Tags or Manage tags, and read the management source.
3. Add or change tags one at a time, or use the bulk editor with one key=value pair on each line.
4. Save.
5. Examine the grouping, attribution, or policy result where you use the tag.
6. Find the change in Trail.

A bulk edit does not change reserved tags.

API operations

Endpoint	Use
GET /v1/resources/{resource_type}/{resource_id}/tags	Read the tags and their management source
PUT /v1/resources/{resource_type}/{resource_id}/tags	Replace the complete user-managed tag set
PATCH /v1/resources/{resource_type}/{resource_id}/tags	Same operation as PUT
DELETE /v1/resources/{resource_type}/{resource_id}/tags/{key}	Remove one user-managed tag

PUT and PATCH replace the whole set. Read the current tags, merge your change, and send the complete set. Errors use the standard envelope from the API overview.

Define a tag taxonomy

Start with two or three keys that your team agrees on, and fix their spelling before you add more.

Dimension	Example	Use
Environment	environment=production	Rollout and incident filters
Ownership	owner-team=trust-platform	Review ownership
Cost	cost-center=cc-1042	Cost attribution
Data	data-classification=restricted	Policy targeting
Workload	service=customer-support	Fleet and agent grouping
Lifecycle	lifecycle=canary	Rollout comparison

Use one value for one meaning. Do not mix prod, production, and prd.

Security rules

Tags are metadata, not a secret store. Do not put credentials, personal data, prompts, incident details, or payment information in a key or value.

When a policy selects resources by tag:

1. Make sure that each resource has the tag.
2. Make sure that no unauthorized principal can change the tag or its source.
3. Test with a tag that matches and with one that does not.
4. Decide what happens when the tag is missing.
5. Examine Trail after each change.

A Console filter does not control access. The API enforces authorization.

Correct attribution

If Usage shows spend as Unattributed:

1. Make sure that the request resolved to the correct agent, gateway, user, and team.
2. Make sure that those resources had the tag when the request occurred.
3. Examine the spelling of the key and value.
4. Make sure that the usage view groups by that tag.

A tag change affects later requests only. It does not change earlier billing records.

Next steps

• Usage Costs and Budgets: group spend by tag and set budgets.
• Roles and IAM Policies: use tags in access rules.
• Trail and Audit Evidence: review tag changes.