Major types
Every CBOR head byte carries a 3-bit major type and 5 bits of additional information. That is the whole structure: unsigned integer, negative integer, byte string, text string, array, map, tag, and everything else.
a26161016162820203 decodes to {"a": 1, "b": [2, 3]}. The leading a2 is a 2-entry map, and nothing else in the stream needs a separator.
Tags carry meaning
A tag does not change how a value is encoded, only how it should be read. Tag 0 is an RFC 3339 date string, tag 1 is epoch seconds, tag 2 and 3 are bignums, and tag 24 wraps an embedded CBOR payload.
Applications register their own. WebAuthn attestation objects and COSE keys are CBOR, which is why an authenticator response pasted here decodes into a readable map.
Indefinite lengths
CBOR can start an array, map, or string without knowing its length and close it with a break byte. Streaming encoders use this constantly. 9f018202039f0405ffff is an indefinite array holding [1, [2, 3], [4, 5]].