---
key: limit-who-can-see-assign-or-remove-a-tag
title: Limit who can see, assign or remove a tag
audience: staff
section: settings
routes: ["/settings/org/tags/:tagUid"]
permissions: ["metadata.tags.update"]
features: ["settings.org.tags"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Open one tag and use its View, Assign, Remove and Subscribe policies to allow or block particular roles and team members, for example so only managers can take a tag off.
keywords: [tag permissions, restrict a tag, who can use a tag, private tag, managers only, lock a tag, hide a tag, tag access]
related: [edit-subscribe-to-or-delete-a-tag, create-a-tag]
---

In the sidebar, open **Settings**, then choose **Tags** under **Records & Fields**, and press **Edit** on the tag's row (or click the row). The tag opens in a panel on the right. The page address is `/settings/org/tags/` followed by the tag, so you can bookmark it or send it to another admin.

Normally anyone whose role has the tag permissions can see a tag, put it on a record and take it off. A tag's policies narrow that for one tag: a "Do not service" tag that only office managers may remove, or a tag only the owner sees. Changing the tag's name, colour or record types is covered in [[edit-subscribe-to-or-delete-a-tag]].

## Before you start

- Your role needs permission to update tags. Without it every field is greyed out and there is no **Save**.
- A policy only narrows. It never lets someone do what their role does not already allow.
- People whose role can manage all tag settings are never limited by a tag's policies.

## Steps

1. Find the section for what you want to limit:
   - **View Policy**: who sees the tag, in the tag list, in tag pickers and on records.
   - **Assign Policy**: who can put the tag on a record.
   - **Remove Policy**: who can take it off. Left on **Inherit**, the **Assign Policy** rules decide removing too.
   - **Subscribe Policy**: who can subscribe to the tag.
2. Change that section from **Inherit** to **Custom**. Four boxes appear.
3. In **Allow Roles**, search for and pick the roles that may do it. Leave it empty to not limit by role.
4. In **Allow Users**, pick the team members who may do it. Leave it empty to not limit by person.
5. In **Deny Roles** and **Deny Users**, pick anyone who must never do it, even if they are allowed above. To take a role or person off a list, click their chip.
6. Press **Save**. Nova says **Tag updated.**

## What you see

- The pill beside each section's switch reads **Global** while it inherits and counts the rules once it is custom.
- A deny always wins over an allow.
- If you fill in both **Allow Roles** and **Allow Users**, a person has to be on both lists.
- People left out of **View Policy** no longer see the tag anywhere, including on records that carry it. The records keep the tag.
- Someone blocked by **Assign Policy**, **Remove Policy** or **Subscribe Policy** who tries anyway gets an error saying the tag's policy denies this action.

## If something looks different

- A section is back on **Inherit** after you saved: you switched it to **Custom** but left all four lists empty, so there was nothing to keep.
- Every field is greyed out and only **Close** is at the bottom: your role cannot update tags.
- The panel says **Unable to load tag details.**: the tag was deleted, or its **View Policy** leaves you out.
- You locked yourself out with **View Policy**: ask someone whose role can manage all tag settings to open the tag and change it back.

[[route:/settings/org/tags|Open Tags]]