Cardinality is the thing that kills a metrics store

Every distinct combination of label values is a separate time series stored for the whole retention period, and one bad label is millions of them.

// a series per order. forever.
$counter->inc(['order_id' => $order->id]);

// bounded, by construction
$counter->inc(['route' => $route->uri(), 'status' => $status]);

// the rule: a label's values must be a set you could
// list. if you cannot, it belongs in a log line with a
// trace id, not in a metric.

The code that does this looks exactly like the code that does not, which is why a review will not catch it — ['user_id' => $id] reads like a reasonable label. A limit configured in the metrics server and an alert on the series count are worth more than the convention, because the failure is the monitoring system running out of memory during an incident. A path with an id in it is the same bug wearing a different hat.