Rule 3 of 8 · Chapter III — Guardrails & Cost
Every resource carries owner, env, and expiry tags from birth.
Why this rule exists
The untagged resource is the one nobody dares delete and everybody pays for. Owner answers "who do I ask", env answers "can this hurt users", expiry answers "why does this still exist".
In practice
Enforce with Azure Policy (deny or append on create). Sweep monthly for expired expiry tags — that list is your decommission queue.