Help center Get started Knowledge center Product documentation API documentation
Account Admin
Getting started
How to navigate the Admin tab How to set up a new workspace How to work out why a user can’t see something
User Management
How to create a user How to assign a role to an existing user How to edit a user’s profile How to reset a user’s password How to deactivate or reactivate a user How to delete a user How to give a user access to more than one organization
Roles Management
How to create a role How to edit a role How to assign a security tag to a role How to delete a role
Group Management
How to create a group How to create a subgroup How to edit a group How to delete a group
Organization Management
How to create an organization How to configure organization filter parameters How to edit an organization How to delete an organization
Security Tags
How to create a security tag How to edit a security tag

How to create a security tag

Create a tag that controls what different roles see when they open a Report, a column’s values deidentified rather than raw, or a Chart widget governed by its own access policy. Creating the tag is the first of four stages; on its own it does nothing.

Before you begin

You need:

  1. The Account Admin role: the Security Tags tab is visible only to Account Admins
  2. A decision on what the tag should do, since Secure Options and Report Access Options are set at creation
  3. What you intend to apply it to: a column, a Chart, or both and the roles that should carry it

A tag is applied to something specific rather than to a Report as a whole. There are two places it can go, and they do different jobs:

  1. A column inside a custom script: this governs how that column’s values are presented. The Report opens normally with every column present; the values in the tagged column appear differently to people holding a role that carries the tag.
  2. A Chart inside a Report: attached in Lens → Design by a Lens Designer, from the artifact’s three-dot menu. This works at the artifact level, so a single Report can contain widgets that behave differently for different audiences.

Either way, the point is the same: one Report serves audiences with different data entitlements, with no second copy to build and maintain.

A tag goes through four stages:

  1. Created here, in Admin → Security Tags, where its options define what it does
  2. Paired with a role in Admin → Roles Management, so holders of that role acquire its access semantics
  3. Applied to a column or to an artifact
  4. Evaluated at runtime, when a user opens the artifact and their roles are checked against the tag

Missing any stage, the tag has no effect and produces no error.

Steps

Step 1. Open Security Tags

From the main navigation, click Admin, then open the Security Tags tab. The existing tags are listed.

Step 2. Start a new tag

Click the add icon in the bottom-right corner of the screen. The Create Security Tag dialog opens.

Step 3. Name the tag

Enter a Security Tag Name. This is the name Account Admins see in Roles Management and whoever applies the tag sees in the custom script, so name it for what it does to the data, “Deidentify PII” rather than “Tag 3”. Two people in different parts of the platform have to pick the right one from a list.

Step 4. Set the options

  1. Secure Options: Controls how the tag secures the column.
  2. Report Access Options: Controls what access the tag grants where it’s applied

These two fields are what the tag actually does, the name is only a label. Get them right at creation if you can. They can be edited later, but the edit reaches everything the tag is already applied to, across every role carrying it.

Step 5. Save

Click Save. The tag appears in the Security Tags list and is immediately selectable in Roles Management.

Result

The tag exists and can be assigned to roles. It has no effect on anything yet and no data is masked; no presentation has changed.

To put it to work, pair it with the roles that should carry it, then get it applied to a column in a custom script, or to a Chart in a Report. Both paths are covered in How to assign a security tag to a role.

Common issues

  1. The Security Tags tab isn’t visible. You don’t hold the Account Admin role. Another Account Admin can grant it.
  2. I created a tag and nothing changed. Expected. A tag on its own does nothing, it has to be paired with a role and applied to a column or an artifact.
  3. I’m not sure which options to choose. Check with whoever set the data-handling requirement before saving. The options determine the actual behavior, and changing them later affects everything the tag is already applied to.