AIKIDO-2026-286632

TL;DR

Dumping a Union type that uses storage: :map_with_tag keeps a tag key already present in the submitted value instead of forcing the configured tag. A caller can submit a value validated as one union arm while carrying the tag of a different arm, so it is loaded from storage as the other arm, which can bypass policies that key authorization on the arm type. The fix forces the configured tag when dumping a map_with_tag union arm.