Permissions & RBAC

Use tags

Create tags and tag categories, add tags to your items, and learn what tags control in ITVA.

Tags are labels that you add to items such as devices, probes, and credentials. ITVA uses tags to decide who can see an item, and which schedules, alerting rules, and maintenance windows apply to it. In this guide, you create a tag and add it to your items.

Tags and tag categories

Each tag belongs to one category. ITVA shows a tag as category:name. For example, a site category can hold the tags site:london and site:paris.

Each tag name must be unique in your organization, even across categories. You cannot have both site:london and team:london. Category names must also be unique.

Before you begin

To see tags, your role must have View set to All for Tags. To create or change tags, it must also have Manage set to All. Administrators can always do both.
To add tags to an item, you must be able to manage that item.

Create a tag category

In the portal, go to Inventory > Tags. Tags is under Management.
Select New Tag Category.
In Name, enter a name for the category. For example, site, team, or environment.
Optional: In Description, enter what the category is for.
Select Save.

Create a tag

On the Tags page, select New Tag.
In Name, enter a name for the tag. For example, london.
Optional: In Description, enter what the tag is for. The description shows next to the tag when people select tags.
Under Category, select Select Category. In the Select Tag Category panel, select Select next to the category, then select Close.
Optional: In Devices, Interfaces, and Probes, select the items to tag now.
Select Save.

Add tags to an item

You can add tags on the item's page, or in the item's form when you create or edit it.

On the item's page:

Open the item. For example, a device.
Select Tags. The Select Tags panel opens.
Select each tag the item needs. To make a tag here, select New.
Select Select.

In a form, select the Tags field. The same Select Tags panel opens.

Caution: Before you remove a tag from an item, make sure that you still have access to the item through another tag. If you do not, you cannot see the item after you save.

What a tag does on each item

Item	Where to add tags	What the tag does
Devices	Device page or form	Limits who can see the device. Selects the device for schedules, alerting rules, and maintenance windows with the same tag.
Device folders	Folder form	Limits who can see the folder. Every device in the folder also gets the folder's tags for access, schedules, alerting rules, and maintenance windows.
Interfaces	Interface page	Limits who can see the interface. Interfaces also get the tags of their device and its folder.
Probes	Probe page or form	Limits who can see the probe. Alerts raised for the probe get its tags.
Credentials	Credential form	Limits who can see the credential.
Certificate enrollments	Enrollment page	Limits who can see the enrollment and the certificates it issues.
Certificates	Certificate page	Limits who can see the certificate and its TLS applications.
Diagram folders	Folder form	Limits who can see the folder and the diagrams in it.
Alerting monitors	Monitor form	Limits who can see the monitor. Links the monitor to the alerting rules with the same tags.
Alerting rules	Rule form	Applies the rule to devices that have the tag, or are in a folder that has it.
Schedules	Schedule form	Runs the schedule on the devices, subnets, and workflows that have the tag.
Maintenance windows	Maintenance window form	Applies the window to devices that have the tag, or are in a folder that has it.
Subnets	Subnet page or form	Selects the subnet for schedules with the same tag.
Workflows	Workflow form	Selects the workflow for schedules with the same tag.
Reporting charts	Chart form	Limits the chart to data from items with the tag.
BGP, IS-IS, and OSPF entries	Entry page	Groups the entry under the tag. Entries also match the tags of their device and interface.
SCIM groups	Settings > Users > SCIM	Gives the group's members access to items with the tag.

How tags control access

A member's permission is a role plus a set of tags. For devices, probes, credentials, certificates, diagrams, and some other items, the role applies only to items that have one of those tags.

If an item of these types has no tags, only administrators can see it. For the full list and the rules, see Access control overview. To give a member tags, see Roles and permissions.

Check that it worked

Go to Inventory > Tags and open the tag.
Look at the cards on the tag's page: Devices, Interfaces, Probes, Certificate Enrollments, BGP Entries, IS-IS Entries, and OSPF Entries. Make sure your items show in the correct card.

For other item types, open the item and look at its tags.

Troubleshooting

If you cannot save a tag, another tag in your organization may already use that name, in any category. Use a different name.
If you create an item and then cannot see it, the item has none of your tags. Ask an administrator to add one of your tags to it.
If Tags is not in the Inventory menu, your role does not have View on Tags.
Caution: If you delete a tag category, ITVA also deletes all the tags in it. ITVA then removes those tags from every item and every permission, and members can lose access.