What tags are NOT
Tags are metadata: not security, not hierarchy, and not a place for sensitive data. Not security: use Azure Role-Based Access Control (Azure RBAC). Not a replacement for resource groups/subscriptions. Not secret storage: tags are plain text. Use tags to label, not to protect.