az policy definition create writes a custom policy rule. The rule has two parts: a if condition (what to evaluate) and a then effect (what to do — deny, audit, append, modify, deployIfNotExists). This one denies any resource created without a required tag.