Every page must have an explicit, correct indexing policy — either implicit (default index, follow) on public pages, or an explicit noindex / X-Robots-Tag on staging, admin, thin, or private content. Get this wrong and you either disappear from search or expose what you didn't mean to.
HTML Living Standard — Standard metadata names: robots
Google Search Central — Robots meta tag, data-nosnippet, and X-Robots-Tag