Feature: Tag - labeling for data governance

[TCeason]

Summary

Why

Tags enable metadata governance by attaching key-value labels to objects. Common use cases:

• Compliance: Mark tables as PII, GDPR, HIPAA
• Environment: Track env = 'prod' vs env = 'dev'
• Ownership: Assign cost_center = 'engineering'

---

What

• SQL Syntax

  -- Tag lifecycle
  CREATE TAG sensitivity ALLOWED_VALUES = ('public', 'internal', 'confidential');
  DROP TAG sensitivity;
  SHOW TAGS LIKE 'sens%';

  -- Bind to objects
  ALTER DATABASE analytics SET TAG env = 'prod', owner = 'data-team';
  ALTER TABLE users SET TAG sensitivity = 'confidential';
  ALTER STAGE raw_data SET TAG env = 'dev';
  ALTER CONNECTION snowflake_link SET TAG owner = 'etl-team';

  -- Unbind
  ALTER TABLE users UNSET TAG sensitivity;

  -- Query
  SELECT * FROM system.tags;
  SELECT * FROM system.tag_references WHERE tag_name = 'sensitivity';

• Key Behaviors

Behavior	Description
allowed_values	Optional constraint; exact match (case-sensitive)
DROP TAG	Hard delete; fails if any object still references it
Taggable objects	Database, Table, Stage, Connection
No inheritance	Tags are explicit per-object, no auto-propagation

---

How

• Meta Storage

  __fd_tag/<tenant>/<tag_name>           → TagId
  __fd_tag_by_id/<tenant>/<tag_id>       → TagMeta { allowed_values, comment, created_on }

  __fd_tag_ref/<tenant>/database/<db_id>/<tag_name>                    → TagRefValue
  __fd_tag_ref/<tenant>/table/<db_id>/<table_id>/<tag_name>            → TagRefValue
  __fd_tag_ref/<tenant>/stage/<stage_name>/<tag_name>                  → TagRefValue
  __fd_tag_ref/<tenant>/connection/<connection_name>/<tag_name>        → TagRefValue

  Stage/Connection use names (no stable IDs); Database/Table use IDs (for cascade delete).

• Error Codes

Code	Condition
2750	Tag already exists
2751	Unknown tag
2752	Tag has references (cannot drop)
2753	Value not in allowed_values

---

Tasks

• Phase 3: Tag rbac
• Phase 4: undrop tag
• Phase 5: column-level tag