We currently want basically all servers to have the same firewall rules applied. To do this we have a tag called "firewallable". However it's another task to do, and it's easy to miss one out.
We only have one server for which our default firewall doesn't apply. If we could *exclude* it with a tag instead, that would help us a lot.