[sentry-junior]

The allocation policy decision metrics (db_request_rejected, db_request_throttled, db_request_pardoned) were tagged with referrer, plus the base tags storage_key, is_enforced and policy_class, but nothing that identifies the org or project. So we couldn't tell from Datadog whether a specific org was having queries rejected. This came up while checking whether org 4507549068099584 in DE was rejected after the bytes-scanned limit change.

This adds org_id and project_id tags, taken from tenant_ids, to all three decision metrics in AllocationPolicy.get_quota_allowance. Missing values become no_org_id / no_project_id, matching the existing no_referrer fallback. Allowed queries emit no decision metric, so nothing changes there.

Cardinality: these are now per-org, and per-project where a project is present, on every throttled, rejected or pardoned query. Throttled is the most frequent of the three, so watch Datadog custom-metric usage after deploy.

The base-policy tests now assert the new tags on the rejected, throttled and pardoned metrics. I couldn't run the tests locally because my sandbox has no Redis or Python 3.10+, so this relies on CI.

--

View Junior Session [Sentry]

[pbhandari]

2 asks:

• let's also get project_id while we're already here.
• let's make sure this gets tagged on all the code paths and not just when we're rejecting.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3735280. Configure here.}