One thing to watch out for, since they're managed under Organizations you might expect that they inherit in the same way that Service Control Policies do... and

One thing to watch out for, since they're managed under Organizations you might expect that they inherit in the same way that Service Control Policies do... and they kind of do (in that a tag policy attached to a root or OU applies to every downstream OU and account), but these policies have "value-setting operators" and "child control operators" [0] that let downstream tag policies carve out exceptions in a way that I haven't quite wrapped my head around yet. SCPs are conceptually very simple and easy to reason about. Not so with tag policies (and, I guess, "backup policies" or "Artificial Intelligence (AI) services opt-out policies", which are both new since the last time I looked at this documentation). [0]