Really solid framing — “share the rules, not the tools” is the right level of abstraction for a two-cloud estate, and the one-tag-scheme rule is the one I would defend hardest. Two additions from experience: first, give cross-cloud data transfer its own budget line and alert threshold rather than folding it into each project budget, since egress is usually the line item that surprises people and it does not belong cleanly to either cloud's budget. Second, enforce the tag scheme with policy — SCPs on the AWS side, Azure Policy deny or append on the other — rather than relying on people remembering the spelling. Then the monthly review catches drift instead of discovering a month of untaggable spend. The named-owner rule pairs well with that: alerts routed to the owner named in Rule 3 actually get read, while alerts sent to a shared inbox do not.