Limit who can see, assign or remove a tag

Open one tag and use its View, Assign, Remove and Subscribe policies to allow or block particular roles and team members, for example so only managers can take a tag off.

In the sidebar, open Settings, then choose Tags under Records & Fields, and press Edit on the tag's row (or click the row). The tag opens in a panel on the right. The page address is /settings/org/tags/ followed by the tag, so you can bookmark it or send it to another admin.

Normally anyone whose role has the tag permissions can see a tag, put it on a record and take it off. A tag's policies narrow that for one tag: a "Do not service" tag that only office managers may remove, or a tag only the owner sees. Changing the tag's name, colour or record types is covered in Edit, subscribe to or delete a tag.

Before you start

• Your role needs permission to update tags. Without it every field is greyed out and there is no Save.
• A policy only narrows. It never lets someone do what their role does not already allow.
• People whose role can manage all tag settings are never limited by a tag's policies.

Steps

1. Find the section for what you want to limit:
   • View Policy: who sees the tag, in the tag list, in tag pickers and on records.
   • Assign Policy: who can put the tag on a record.
   • Remove Policy: who can take it off. Left on Inherit, the Assign Policy rules decide removing too.
   • Subscribe Policy: who can subscribe to the tag.
2. Change that section from Inherit to Custom. Four boxes appear.
3. In Allow Roles, search for and pick the roles that may do it. Leave it empty to not limit by role.
4. In Allow Users, pick the team members who may do it. Leave it empty to not limit by person.
5. In Deny Roles and Deny Users, pick anyone who must never do it, even if they are allowed above. To take a role or person off a list, click their chip.
6. Press Save. Nova says Tag updated.

What you see

• The pill beside each section's switch reads Global while it inherits and counts the rules once it is custom.
• A deny always wins over an allow.
• If you fill in both Allow Roles and Allow Users, a person has to be on both lists.
• People left out of View Policy no longer see the tag anywhere, including on records that carry it. The records keep the tag.
• Someone blocked by Assign Policy, Remove Policy or Subscribe Policy who tries anyway gets an error saying the tag's policy denies this action.

If something looks different

• A section is back on Inherit after you saved: you switched it to Custom but left all four lists empty, so there was nothing to keep.
• Every field is greyed out and only Close is at the bottom: your role cannot update tags.
• The panel says Unable to load tag details.: the tag was deleted, or its View Policy leaves you out.
• You locked yourself out with View Policy: ask someone whose role can manage all tag settings to open the tag and change it back.

Open Tags