azure policy to only allow specific tags to be created

Question

I need to configure an azure policy to make sure that azure contributors create resources using a very specific set of "allowed" tags. example of allowed tags: app