A tag is a label that can be attached to inventory assets so that they can be grouped, filtered, and reported on. Two types of assets can be tagged:

• Cryptographic assets, such as keys, certificates, and secrets.
• AI assets, such as agents, MCP servers, and tools.

Tags are global within a tenant. The same tag can be assigned to a certificate and an agent at the same time. 

Each tag has:

• A name and description.
• An assignment mode:
  • Manual
  • Automated
• An edit mode (Automated tags only): 
  • Basic
  • Advanced

Indicates whether the rule was created using the visual rule builder (Basic) or the advanced query editor (Advanced).

• A status:
  • Active
  • Inactive

The status of a tag defaults to Active and is retained for future use. It currently does not affect tag behavior.

• Creator and last updater information, including timestamps.

Tag Types

There are two types of tags:

• Manual: Assigned and removed by a user, such as a tenant administrator.
• Automated: Assigned and removed automatically based on rules that evaluate asset properties. You can create rules for cryptographic assets, AI assets, or both. An Automated tag must include at least one rule.

Important: When creating a tag, you must choose whether the tag is Manual or Automated. This setting cannot be changed after the tag is created. A tag cannot function as both a Manual and an Automated tag.