diff --git a/constants.dhall b/constants.dhall
index d6e9ade..da63c61 100644
--- a/constants.dhall
+++ b/constants.dhall
@@ -46,6 +46,7 @@ let tag =
       , setec = "tag:setec"
       , ci_agent = "tag:ci-agent"
       , kvm_proxy = "tag:kvm-proxy"
+      , tag_authority = "tag:tag-authority"
       }
 
 let host =
diff --git a/fragments/core.dhall b/fragments/core.dhall
index 744fe36..7c4ee06 100644
--- a/fragments/core.dhall
+++ b/fragments/core.dhall
@@ -20,52 +20,70 @@ let groups
 let tagOwners
     : List T.TagOwner
     = [ { mapKey = C.tag.dollhouse
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.services
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.k8s
         , mapValue =
-          [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ]
+          [ C.tag.tag_authority
+          , C.tag.k8s_operator
+          , C.autogroup.admin
+          , C.group.dollhouse_admins
+          ]
         }
       , { mapKey = C.tag.k8s_operator
         , mapValue =
-          [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ]
+          [ C.tag.tag_authority
+          , C.tag.k8s_operator
+          , C.autogroup.admin
+          , C.group.dollhouse_admins
+          ]
         }
       , { mapKey = C.tag.mcp_proxy
         , mapValue =
           [ C.tag.k8s_operator, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.tsidp
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.dev
-        , mapValue = [ C.autogroup.admin, C.group.developers ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ]
         }
       , { mapKey = C.tag.staging
-        , mapValue = [ C.autogroup.admin, C.group.developers ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ]
         }
       , { mapKey = C.tag.qa
-        , mapValue = [ C.autogroup.admin, C.group.developers ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.developers ]
         }
       , { mapKey = C.tag.exit_node
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.switch
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.subnet_router
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.tinyland_lab_common
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.tinyland_lab_sunshine
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.tinyland_lab_moonlight
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.tinyland_lab_crush
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
@@ -83,10 +101,12 @@ let tagOwners
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.rj_gateway
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.setec
-        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        , mapValue =
+          [ C.tag.tag_authority, C.autogroup.admin, C.group.dollhouse_admins ]
         }
       , { mapKey = C.tag.ci_agent
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
@@ -94,6 +114,9 @@ let tagOwners
       , { mapKey = C.tag.kvm_proxy
         , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
         }
+      , { mapKey = C.tag.tag_authority
+        , mapValue = [ C.autogroup.admin, C.group.dollhouse_admins ]
+        }
       ]
 
 let acls