For example: “all instances must have a cost centre tag associated with them”, or “no instances may have an ENI in a subnet with an internet gateway”