Three lookalike mechanisms, only one can gate a policy.
Confusing these is one of the most common ACE exam trap categories.
MechanismJobCan gate IAM/policy?
LabelFree-form key:value, billing & inventoryNo
Network tagPlain string, firewall/route targeting onlyNo
Resource Manager tagIAM-governed key:value, org-level schemaYes
Resource Manager tags are the same mechanism behind the newer Secure Tags in Cloud NGFW firewall policy — covered later in this deck.