MCM-21 — Reconcile Tag Values Outside the Allowed List
Surface tag values that exist on resources but aren't in a tag's allowed list, and let an Admin migrate or allow-list them.
MCM-21 — Reconcile Tag Values Outside the Allowed List
← Back to Custom Tag Improvements overview
As an Enterprise Admin,
I want to see every value a tag actually has on resources — even values outside the tag's current allowed list — and choose to either migrate those resources to an allowed value or add the value to the allowed list,
so that I never lose visibility into real tag data just because it doesn't match current policy.
Acceptance Criteria
- A tag's Resources/Values view shows every distinct value currently present on resources for that tag key, regardless of whether the value is in
TagItem.allowedValues. - Values not present in
allowedValuesare visually flagged as out-of-policy (e.g. a distinct badge/indicator), not silently hidden or merged with allowed values. - For each out-of-policy value, the Admin has two actions:
- Add to allowed list — appends the value to
TagItem.allowedValuesfor that tag key, going forward treating it as policy-compliant. - Migrate — bulk-updates the resources currently carrying that value to a chosen allowed value instead, via the existing tag-update path (subject to the 50-resource-per-call cap, see MCM-22).
- Add to allowed list — appends the value to
- If a tag has no
allowedValuesconfigured at all (free-text tag), no value is ever flagged as out-of-policy — the flagging only applies to tags with a configured allowed list. - After either action, the out-of-policy indicator for that value is cleared (added values no longer show as out-of-policy; migrated resources now carry an allowed value).
Technical Design
This adds a new capability to compute every value actually in use for a tag key across resources, which isn't aggregated anywhere today. The two Admin actions reuse existing capabilities rather than adding new ones: "Add to allowed list" updates the tag's allowed-values policy directly, and "Migrate" reuses the existing bulk tag-update capability (the same one used by the Custom Tag Detail page's Resources tab), subject to the same 50-resource-per-call cap as MCM-22.
UI / Frontend Changes
- Tag's Resources/Values view gains a visual out-of-policy badge/indicator on any value not present in
TagItem.allowedValues. - New per-value action menu (or inline buttons) offering Add to allowed list and Migrate for each out-of-policy value.
- New "Migrate" flow: a value picker constrained to the tag's current allowed values, followed by the existing bulk tag-update confirmation/progress UI (reused from the Custom Tag Detail page's Resources tab).
- Out-of-policy indicator clears immediately after a successful add-to-allowed-list or migrate action, without a full page reload.
- No change to the view for tags with no configured allowed list — no badges, no reconciliation actions shown.
MCM-20 — Custom Tag Improvements
Overview, personas, and architecture for the Custom Tag Improvements initiative — allowed-list reconciliation, resource-view editing, and topology-driven tag suggestions.
MCM-22 — Enforce the 50-Resource Cap in the Bulk Tag Update UI
Prevent selecting more than 50 resources for a single tag update, matching the limit already enforced by the API.