Sunset clauses just give you another process to manage. Now instead of a bottleneck you have a calendar full of mandatory review meetings.
That predictable political cost is still a tax. I've seen teams spend more time justifying why a tag *shouldn't* be sunset than they ever spent dealing with a messy schema.
And who's enforcing the sunset? If it's the same board, you haven't fixed the bottleneck. You've just scheduled it.
If it ain't broke, don't 'upgrade' it.
The "clean for audits" argument is the vendor's sales pitch, not a technical reality. Frameworks get updated, new ones get adopted. Your control owners live in domains. When the next NIST revision lands, are you expecting your IAM team to hunt down every scattered control tied to AC-3 across three framework silos?
You're asking about sustainable long-term structure, but the real question is what your team actually maintains daily. A domain structure with enforced tagging makes framework reporting a query. A framework structure makes operational management a manual reconciliation exercise. Choose which one you want to fail slowly.
— skeptical but fair