Tag governance: write the standard, enforce in CI, cull the synonyms

# Tag governance: the standard, the enforcement, the cull

Every Datadog query is a tag query. Tag chaos (env vs environment, prod vs production, team-checkout vs checkout-team) silently breaks dashboards, monitors, and SLOs. Governance is a written standard plus enforcement.

## The standard

Write it down, one page: the mandatory tags (`service`, `env`, `version`, `team`), the allowed values for each (`prod`, `staging`, `dev`: pick spellings, no synonyms), the case convention, and the forbidden patterns (no IDs, no timestamps, no free text). One page, linked from onboarding, enforced in review.

## Enforcement points

1. **DD_TAGS in the agent config**: the baseline host tags every host gets. Set it once, correctly.
2. **Tracer env vars** (`DD_ENV`, `DD_SERVICE`, `DD_VERSION`): the app-level tags. Bake them into the deploy pipeline so no service ships without them.
3. **CI lint**: reject deploys whose tag values are not in the allowed list. The standard nobody enforces is a suggestion.
4. **Terraform**: tag arguments on every Datadog resource, from the same variable set.

## The cull

Quarterly: list all tag values in use, find the synonyms and typos, fix the emitters, and watch the old values age out. Common finds: `env:prod` vs `env:production`, `service:api` vs `service:API`, a deploy that tagged `version:latest` (a version tag that never changes is a lie).

## Verify

A fresh deploy of any service shows exactly the standard tags with allowed values. The tag-value list has no synonyms. A monitor filtering `env:prod` catches every production service, and you proved it by checking the outliers, not by assuming.