Ten required tags. Seven optional security tags. Every key prefixed with ifo4_. Every value lowercase, hyphen-separated. Anything else fails the validator and blocks the deploy.
Key case
lowercase + underscores
Value case
lowercase + hyphens
Required prefix
ifo4_
Max key length
63
Max value length
63
Encoding
ASCII
Required tags (10)
All ten must be present on every IFO4 cloud resource by 2026-05-25. Validator returns exit-code 1 if any are missing.
01
ifo4_cc
Cost Center
Atomic financial accountability unit. Every dollar lands here.
Format
cc-NNNN
Example
cc-1001
Inheritable
No (per-resource)
02
ifo4_org
Organization
Top-level legal entity / billing org. Stable across rebrands.
Format
org-slug
Example
ifo4
Inheritable
Yes (project / folder)
03
ifo4_app
Application
Logical business application. May span many services.
Format
app-slug
Example
matrix
Inheritable
Yes (project / folder)
04
ifo4_svc
Service
Concrete deployable component within an application.
Format
svc-slug
Example
matrix-advisor
Inheritable
No (per-resource)
05
ifo4_owner
Owner
Engineering owner. Format: handle. Maps to humans in the people registry.
Format
handle
Example
derris
Inheritable
Yes (project / folder)
06
ifo4_env
Environment
Deployment lane. Drives FinOps allocation rules and access policy.
Format
enum
Allowed
productionstagingqadevsandboxephemeral
Inheritable
Yes (project / folder)
07
ifo4_platform
Platform
Always "ifo4" for IFO4-managed resources. Lets cross-tenant joins work.
Format
constant
Allowed
ifo4
Inheritable
Yes (project / folder)
08
ifo4_lifecycle
Lifecycle State
Workload lifecycle. Drives commitment vs on-demand decisions and right-sizing cadence.