Overlapping names, three genuinely different mechanisms.
Confusing these is one of the most common early GCP mistakes — only one of the three can ever gate an org policy.
MechanismUsed forGates a policy?
LabelsCost attribution, console filteringNo
Network tagsTargeting firewall rules at VMsNo — firewall only
Resource Manager tagsIAM-controlled, typed key:valueYes
firewall-targeting.sh
# target-tags matches NETWORK TAGS only gcloud compute firewall-rules create allow-egress \ --target-tags=allow-pubsub-egress
A rule targeted at
team: platform (a label) matched zero instances — no error, since firewall targeting only ever reads network tags. The console shows both as similar chips, which is exactly why the mix-up happens.