The problem with metadata
Every cloud estate has labels, and almost none of them can be trusted. They are typed by hand, they drift, they are missing where they matter and wrong where they are present, and nothing is allowed to depend on them because everyone knows it. Meanwhile the controls that should depend on something, which environment a project is in, which regulated scope, who owns it, make do with folder names and naming conventions.
This reference model separates the two jobs that metadata is asked to do. Tags decide: they are read by organization policy, IAM conditions and firewall rules, and only the pipeline binds them. Labels describe: they are read by people, reports and cost tooling, and the stacks stamp them. Neither is typed by hand, and one typed by hand is drift.
One record, written twice
The source of truth is one record per project, held in code. The project module binds six identity tags on the project in the apply that creates it: which estate, environment, portfolio, team, classification and regulated scope it belongs to. In the hub-and-spoke estate a project is born tagged; no project exists without them. In the established estate they are backfilled. A rule that reads a tag gives the stricter result to a project without one, so a missing tag can only make things tighter.
Each stack sets provider-level default labels, so every resource it builds that supports labels carries the standard set: seven labels for ownership, purpose and provenance. A constraint may require that a label is present on new resources; no access or network decision ever reads one.
Firewall identity is derived, not typed
Firewall rules read secure tags, which are IAM-governed and bound only by the pipeline. The keys, portfolio, role, environment, regulated scope and quarantine, are created once at organization scope, so one set of values serves the established network and every spoke, and a rule in one spoke can name a source tag in another spoke on the same hub. The values are derived by the plan policy from the project's identity tags, never written by a person; a set that lacks an identity tag fails the plan.
Virtual machines do not inherit tags from a folder or the organization, so firewall tags are bound on each instance and set on each template and node pool, by the spoke and workload stacks in the hub-and-spoke estate and by a fence stack per tier in the established network. A tag identifies an interface. Serverless services, connectors, load-balancer proxies and on-premises hosts carry none and are admitted by range.
A rule cannot require two tags. It applies to a machine bound to any one of its target tags and matches any one of its sources. That single fact shapes the model: firewall values carry the portfolio tier, one portfolio in one environment, and separation is written as a deny between one tag on each side.
Who may bind what
Identity tags are bound by the project module, on merge. Firewall tags are bound by the stacks that build machines. Privileged tags, the exposure tag that allows a public front door, the AI tier, the data class, need security approval on the first value and on every change, and are bound on the project only by their own stacks. Programme tags that track a migration are bound on established-estate projects only and removed when the wave closes; the gate tag is set by the gate stack when a readiness record merges and lapsed by a scheduled run when nothing lands.
Quarantine is the one tag the pipeline does not bind. In an incident, the incident tooling's identity binds it on one instance, without a merge request, and every binding pages. A binding by any other principal pages too, and is removed. The organization's firewall policy puts the quarantine deny at the very top, above every other rule, with one allow for the forensic source.
What enforces the model
Who may bind a tag is itself restricted by IAM on the tag values. Constraints that read tags are tested in dry run before enforcement and give the stricter result where the tag is absent. A scheduled run removes expired exception bindings and lapses expired gate tags, and because it only tightens, it is allowed to apply without a person. Drift detection compares the live inventory with what the stacks declared, and a hand-bound tag is reverted and alerted. The whole model fails safely: a missing tag tightens, a typed tag is undone, and the one tag humans bind is the one that isolates.
Why this is governance, not housekeeping
Once the tags are trustworthy, the controls can be simple. Separation between environments is a deny between two tag values. A public front door is allowed where one tag says so. A restricted project is one whose data-class tag says so, or whose tag is missing. The readiness gate reads a tag. The exception machinery is a dated tag with an expiry. Every one of those rules is small because the fact it reads is reliable, and the fact is reliable because only the pipeline writes it.