Manage tags
A tag is a reusable label you attach to one or more (platform, scope)
pairs. Instead of listing every scope a rule should cover, you tag the scopes
once and then point a policy or guardrail at the tag. Tag three risky scopes
as sensitive, and a single require-approval guardrail on tag:sensitive now covers all three — and any
scope you tag later.
Tags live on the Tags page — Governance → Tags in the sidebar (/tags,
admins only). The policy editor links there too.
Built-in tags
Six tags are always available without any setup: read, write,
destructive, pii, financial, and admin. The policy editor’s safety
presets use destructive, financial and pii.
Rules on tag:pii only take effect when your organisation has the PII redaction beta switched on (an Enterprise beta). Without it, a tag:pii rule is ignored.
Add a tag binding
A custom tag is created by binding it to a scope. Under Add a tag binding,
pick the platform, pick the scope, and type the tag id — lowercase
letters, digits and underscores only (for example sensitive,
fraud_review_only). Click Add tag. The id is what rules reference as
tag:<id>. Tags are scoped to your org — they’re invisible to other orgs.
To put the same tag on more scopes, add another binding with the same tag id. A scope can carry more than one tag, and the same tag can span multiple platforms — that’s the point: one label, many scopes, across connectors.
Existing tags lists every binding (tag, platform, scope). Remove deletes one binding; a tag that a policy still references can’t be removed until you unbind it there.
Use a tag in a rule
Once a tag exists, you can target it:
- Guardrails — org-wide deny or require-approval on a tag, optionally
filtered by role (the classic “members never see
tag:pii”). See Manage org guardrails. - Policies — the safety presets act on built-in tags, and on the Team plan and above the policy editor’s Conditions (advanced) rules can target any tag. See Manage user policies.
A tag rule resolves to every scope currently carrying that tag at decision time, so tagging a new scope immediately brings it under existing tag rules — no rule edits needed.