Design a Cross-Product Tagging Service (Jira, Confluence, Azure DevOps)

The prompt sounds like a warm-up: "We run an issue tracker, a wiki and code review: think Jira, Confluence and Bitbucket, or Azure DevOps work items. We want one tagging service shared by all of them. Anyone can tag an issue, a page or a pull request, click a tag to see everything carrying it across every product, and get suggestions as they type. Design it."

Most candidates hear "tags" and draw a join table: tag, content, tag_content, an index in each direction, done in ten minutes. The table really is that simple. About 10 billion assignments fit in roughly 3.2 TB, and the busiest writes peak at about 1,400 a second. What the join table hides is that the tagging service owns the tags, but not the content and not the permissions. A tag page is a query across three products, each guarding its own items with its own rules. A contractor who clicks checkout-outage must not learn that a postmortem exists in a space they can't open. A count of "4 items" can leak a security issue they will never see. And the content keeps moving between projects, getting deleted and getting locked down, underneath an index that has to stay true.

The Trap Built Into a Friendly Question

Two failures show up again and again:

• The Join-Table Finisher: designs tag_content with two indexes, adds a cache, and calls it done. The tag page happily lists every item carrying the tag, including a restricted security issue and a postmortem from a private space. Signal: never asked who is allowed to see what.
• The Permission Copier: realizes permissions matter and copies every product's ACLs into the tag index, so the tagging service can filter by itself. Now there are two permission systems, they drift, and the drift is a data leak. Signal: solved the visible problem by creating a worse invisible one.

The passing performance asks the permission question in the first five minutes and builds around one rule: the index narrows, the owner decides. The tagging service filters candidates down by tenant and by the containers (projects, spaces, repos) a user can reach. The product that owns each item makes the final call on whether to show it. Counts and suggestions get the same discipline, because they leak too.