Resource merge precedence and attribute-filtering limits

OpenTelemetry Resource attributes carry process metadata, including service identity, host details, and deployment context. In SDKs that support a ResourceProcessor, attributes can be filtered or transformed before export, but the protection boundary is less clear when several Resource sources are combined. The concern is accidental exposure if exported metadata reaches an unintended endpoint.

The goal is to define one cross-SDK policy for a sensitive attribute key: which Resource wins on a collision, and whether filtering occurs after every merge. Resource immutability does not settle those points, and the available merge and processor APIs differ across Java, Go, and Python. Because these APIs vary by SDK and release, the comparison should be pinned to the versions selected for deployment.

Which precedence rule does each SDK implement when both Resources contain the same attribute key? Which of these SDKs supports a ResourceProcessor, and does it run after resource merging? Should a sensitive-key policy require a post-merge drop to prevent a later source from overriding the intended value?