A tagged union is a composite data type that stores one of several possible value types together with a tag identifying which one is present. The tag lets code select the correct interpretation at runtime, and it is widely used to model variant data safely in systems programming and serialisation formats.
Tagged Unions in Systems Design
Tagged unions are a compact way to represent variant data: one tag says which member is active, and the stored value must match that tag. That simple pairing reduces ambiguity in low-level code and serialised data, because readers can validate the shape of a value before interpreting it.
They are common in systems programming, wire formats, parsers, and protocol implementations where a value may legitimately take several forms. The design is especially useful when the variants are mutually exclusive, because it turns an implicit assumption about structure into an explicit runtime discriminator.
Why Tagged Unions Are Safer Than Ambiguous Structures
The main advantage of a tagged union is that it makes invalid interpretation harder. Without a tag, code may guess which field is present or rely on external context, which increases the chance of reading the wrong type, misparsing data, or treating stale memory as a valid object.
Used well, the tag and payload must travel together through the full lifecycle of the value. That matters in serialisation formats and RPC payloads, where the receiving side needs a reliable way to decide which decoding path to take without trusting field order, naming conventions, or out-of-band hints.
How Tagged Unions Are Used in Practice
In code, tagged unions often appear as enums paired with variant storage, sum types, or discriminated unions. The implementation details vary by language, but the core rule is the same: every valid state has one explicit tag, and the code that consumes the value switches on that tag before accessing the associated data.
In data interchange, they support versioned schemas and extensible protocols. A producer can add a new variant while preserving the same top-level contract, provided consumers either understand the new tag or safely reject it. This makes tagged unions a practical tool for backward compatibility when the schema is designed with variant growth in mind.
Correctness, Validation, and Failure Modes
The most important failure mode is tag-payload mismatch, where the tag says one thing but the stored bytes contain another. That can happen through memory corruption, unsafe casts, deserialisation bugs, schema drift, or hand-rolled encoding logic that fails to enforce invariants.
Well-designed implementations make invalid states difficult to construct and easy to reject. In safe languages that means leaning on type system support; in lower-level languages it means carefully validating the discriminator, constraining constructors, and ensuring the active variant is always tracked consistently through updates, copying, and serialisation.
Risk and Threat Considerations
Tagged unions are not inherently a security control, but they can reduce classes of parsing and memory-safety mistakes that attackers often exploit. If the tag is not validated, an adversary may trigger type confusion, malformed decoding, or logic that operates on the wrong branch of a protocol or parser.
Failure mechanism: A corrupted, forged, or desynchronised tag causes code to interpret the payload as the wrong type, which can produce crashes, information disclosure, or unsafe control flow.
Impact: The consequence is usually reliability loss first, but in low-level environments the same flaw can become a memory-safety issue or an input-validation bypass that changes how hostile data is processed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V1 — Encoding and Sanitization | Tagged unions depend on strict input encoding and decoding rules. |
| V15 — Secure Coding and Architecture | The pattern is a language-level design choice that reduces type confusion and unsafe casting. | |
| Recommendation — Validate tagged payloads strictly so the discriminator and variant data cannot be misinterpreted. Use typed variants and safe constructors to prevent invalid union states. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Union tags must be validated before downstream processing of variant data. |
| SI-7 — Software, Firmware, and Information Integrity | Corrupted or inconsistent tagged data should be detected before it influences execution. | |
| Recommendation — Validate discriminators before decoding or branching on variant data. Detect and reject malformed variant encodings before they reach sensitive logic. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Secure variant handling is part of robust application code and parser design. |
| Recommendation — Build variant parsing and decoding into secure application design and testing. | ||
Practitioner Guidance
What to watch for: Treat tagged unions as a contract, not just a convenience. The tag, payload layout, and validation logic should evolve together, especially when schemas are shared across services, languages, or trust boundaries.
Practitioner note: Prefer language and library patterns that keep the active variant and the discriminator coupled. Where that is not possible, make deserialisation strict, reject unknown or inconsistent variants explicitly, and avoid ad hoc casts or “best effort” decoding that can hide corruption until it becomes a security or reliability problem.
Related resources from NHI Mgmt Group
- Who should own remediation when an identity is tagged as AI-accessible?
- How should security teams find AI workloads that were never tagged in Kubernetes?
- What breaks when CI/CD AI requests are not tagged at the gateway?
- Why do standing access and weak offboarding create examination risk in banks and credit unions?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org