## TL;DR
Tag enforcement should fill in missing tags, never overwrite existing ones. The Name tag is load-bearing: deploy pipelines, dashboards, and humans all key off it. Change the enforcement to additive-only, restore the overwritten Names from CloudTrail or config history, and reserve Name as a tag your automation may set only when it is absent.

```text
agent's tag enforcement overwrote the name tag, the deploy pipeline keys off name and broke
```

## Use this when
- A tagging run overwrote existing tag values, especially Name.
- Deploy pipelines, monitoring, or cost reports broke after a tagging pass.
- The enforcement script applies tags unconditionally.

## Not for this skill when
- Resources were genuinely untagged and got their first tags. That is the enforcement working.
- You need to rename resources deliberately. That is a migration with a plan, not enforcement.

## Steps
1. Stop the enforcement run. Identify the blast radius: which resources had Name overwritten and when.
2. Restore Names from AWS Config history, CloudTrail, or your CMDB. Verify: spot-check that restored Names match the deploy pipeline's expectations.
3. Change the enforcement logic to additive-only: skip any tag key that already exists on the resource.
4. Maintain an explicit reserved list (Name at minimum) that the automation may never write, even when absent, without human approval.
5. Re-run in dry-run mode and review the would-change list before going live again.
6. Fix the deploy pipeline's fragility too if you can: keying solely off a mutable tag is a risk even without rogue automation.

## Variant phrasings
### tag enforcement overwrote name tag
The incident phrasing.
### aws tagging script broke deployment pipeline
Symptom-level search.
### additive only tagging policy
The preventive framing.

Compatibility: Any tag enforcement (Lambda, Config rules, custom scripts) across AWS resource types.

## Why it happens
Enforcement scripts are written as "ensure these tags exist with these values," and "ensure" becomes "overwrite" in one line of code. Name looks like just another tag to the script, but to everything downstream it is the primary key. Overwriting it is renaming production.

## Edge cases / pitfalls
- AWS Config history retention is limited; restore quickly or the old values age out.
- Some resources genuinely need a Name set at creation by automation; distinguish "set when absent" from "overwrite always."
- Case sensitivity: `Name` and `name` are different tags. Normalize before comparing.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Fb8IFAxoDWPg2y_Lh-BLNg