Overview
A Governed tag is an account-level tag dictionary shared across workspaces. This document describes how to create sensitive tags, create business tags, maintain the tag value list of business tags, and perform management operations such as editing, searching, and deleting tags in Data Catalog > Tag Governance.
DataBuddy splits governed tags into two tabs by purpose: Sensitive Tag is used for security compliance and desensitization control, and Business Tag is used for business classification and asset filtering. The two tabs differ in fields, list display, and creation forms.
Prerequisites
You have activated the DataBuddy service and completed workspace initialization.
To create, edit, or delete tags, the current account must be a root account or a user granted creation permission by a root account or tag owner.
Use Limits
|
Number of Tags | Each tenant can have up to 1000 governance tags. |
Tag Scope | A single data entity (Catalog / Schema / Table / View / Volume / Model) can have up to 50 tags; a single table can have up to 1000 column tags. |
System Tags | The names, types, and descriptions (in Chinese and English) of system built-in sensitive tags (such as class.*) are read-only. Only authorized users can edit security specifications and associated masking policies. |
Across Workspaces | Tag definitions take effect at the tenant level, and all workspaces share one dictionary. |
Operation Steps
Step 1: Going to the Tag Governance Page
2. Select Data Catalog in the left sidebar.
3. Click Tag Management at the top of the page to go to the Tag Governance page.
4. Select Sensitive Tag or Business Tag in the Tab at the top of the page.
The page opens on the Sensitive Tag Tab by default, and the list already contains built-in system sensitive tags from DataBuddy, such as class.cn_id_card and class.financial_account.
Step 2: Creating Sensitive Tags
To create a tag for sensitive identification and desensitization control, follow these steps.
1. On the Sensitive Tag Tab, click + Create Sensitive Tag in the upper-right corner.
2. In the pop-up window, enter the following fields. For details, see the parameter descriptions below:
Tag Name: Required. It serves as the tag Key.
Description: Optional.
Security Standard: In Sensitive Classification Configuration, select the applicable compliance frameworks (PII / GDPR / HIPAA / PCI-DSS / GLBA / CCPA / DPDPA / PDPA / PIPL).
Associated Masking Policy: Select an existing policy from the drop-down list. If no policy has been created, you can select Not Associated for now and bind it later in the tag details.
3. Click OK to complete the creation. The new tag will appear in the sensitive tag list, and the Type column will show "Custom".
Note:
Sensitive tags do not carry tag values. When tagging is performed, only the tag name is specified, and all fields share a unified definition, making it easier to trigger the same masking policy by tag.
Step 3: Creating Business Tags
Business tags are used to classify and filter assets by dimensions such as subject domain, data layer, and business line.
1. Switch to the Business Tag Tab.
2. Click + Create Business Tag in the upper-right corner, and then fill in the pop-up window:
Tag Name: Required. It serves as the tag Key (for example, domain, tier, pii_review).
Description: Optional.
Tag Value: You can add one or more candidate values (such as gold, silver, bronze). When tagging, users select a single value from the candidate values.
3. Click OK to complete the creation.
Note:
If you want users to freely enter tag values during tagging, you can skip presetting any values when creating the tag. The tagged fields will appear as "Other Tags", and users can enter values on the spot in the tagging pop-up window.
Step 4: Maintaining Tag Values for Business Tags
Business tags support continued maintenance of their candidate value list after creation.
1. In the Business Tag Tab list, click the tag name of the target tag to go to the tag details page, where you can view the tag description, Key, and current tag value list.
2. In the tag value list:
Click + Add to add a new tag value.
After selecting several existing tag values, click Batch Delete to remove them.
3. After the modification is completed, the page will be saved automatically.
Note:
Created tag values cannot be directly renamed. To change the spelling of a value, add the correct value first, and then delete the incorrect one. Also, confirm that the value is no longer referenced by any assets to avoid affecting tagged fields.
Step 5: Searching, Editing, and Deleting Tags
1. Search: Enter a tag name keyword in the search box at the top of the Tab, and the list will perform real-time fuzzy matching and filtering. The Sensitive Tag Tab also supports filtering by Type (System, Custom) and Security Standard.
2. Edit: Click the tag name to go to the details pop-up window or details page for modification. Editable fields vary by type:
System sensitive tags: Only the associated masking policy is editable. The tag name, type, description, and security standard are read-only.
Custom sensitive tags: The description, security standard, and associated masking policy are editable. The tag name is read-only.
Business tags: The description and tag value list are editable. After a tag is created, modification is not supported.
3. Delete: Click Delete in the operation column, and then click OK in the confirmation dialog box.
Note:
After a governance tag is deleted, assets and fields already tagged with it will be **automatically converted to "Other Tags"** and retained (tag values remain editable). If the sensitive tag is associated with a masking policy, the association will be removed, and related fields will no longer inherit the policy. Evaluate the impact in advance.
Parameter Description
Parameters for Creating Sensitive Tags
|
Tag Name | Used as the Tag Key for unique identification across the entire platform. | Yes | - |
Description | Description of the business meaning of the tag, up to 500 characters | No | Null |
Security Regulations | Compliance framework to which the tag belongs, multiple selections allowed; used to display as a Badge in the tag list. | No | Null |
Associate Masking Policy | Desensitization policy bound to the sensitive tag; fields automatically inherit the policy after being tagged. | No | Not associated |
Security Standard currently supported values (consistent with the list display):
|
PII | Personally Identifiable Information |
GDPR | EU General Data Protection Regulation |
HIPAA | US Health Insurance Portability and Accountability Act |
CCPA | California Consumer Privacy Act |
PCI-DSS | Payment Card Industry Data Security Standard |
GLBA | US Gramm-Leach-Bliley Act |
DPDPA | India Digital Personal Data Protection Act |
PDPA | Personal Data Protection Act in Singapore / Thailand and Other Jurisdictions |
PIPL | China Personal Information Protection Law |
Parameters for Creating Business Tags
|
Tag Name | Serves as the tag Key (such as domain and tier) | Yes | - |
Description | Description of the business meaning of the tag | No | Null |
Tag Value | One or more candidate values; the user selects one of them when tagging. | No | Empty (No Preset Value) |
Tag List Fields
Sensitive Tag Tab:
|
Name | Tag Key. Click to view details. |
Type | System/custom, filterable. By default, the list is sorted by custom tags first, system tags second, + tag name in alphabetical order. |
Description information. | Tag description |
Security Regulations | Display selected compliance frameworks as a Badge list. |
Masking policy | Associated: displays the policy name (click to go to policy details); not associated: displays the "⚠️ Go to associate" entry. |
Creator. | System tags are system; custom tags are the creator's account. |
Creation Time | Supports sorting by time. |
Business Tag Tab:
|
Name | Tag Key. Click to view details. |
Description information. | Tag description |
Tag Value | Candidate values under this tag, collapsed when there are multiple values. |
Creator. | Creator account |
Creation Time | Support Sorting or Not |
Operation | Delete (with confirmation) |
Verification Result
After creation is complete, you can confirm it in the following ways:
1. You can search for the newly created tag in the corresponding Tab list, and the Type column will show "Custom".
2. Go to the details page of any table. In the tagging dialog box for field tags or table tags, you can select the newly created tag. If it is a business tag with preset values, the configured candidate values will also appear in the tag value drop-down list.
3. For a sensitive tag, after a masking policy is associated and the tag is applied to any field, the "Masking Policy" column of that field automatically displays the policy name + a "🏷️ Tag Inherited" marker.
FAQs
Q: Do custom sensitive tag names need to follow the class.* prefix?
A: Not mandatory. class.* is the naming convention for DataBuddy built-in system tags. Custom sensitive tags can use names that are more business-specific (for example, internal_user_phone), but you only need to avoid reserved characters such as ., ,, -, =, /, and :.
Q: Can business tags be converted to sensitive tags? What about the other way around?
A: Type conversion is not supported. If you need to switch the purpose, create a tag of the target type, re-tag the assets, and then delete the old tag.
Q: Which assets are affected by tag deletion?
A: After deletion, assets already tagged with this tag will be automatically converted to "Other Tags" to retain tag information, and no data will be lost. However, the masking policy association of the sensitive tag will be removed, and fields that previously inherited the policy through the tag will no longer be masked. Evaluate the impact before proceeding.
Q: Can all users create governance tags?
A: By default, only the root account has full management permissions. Other users can create governance tags only after being granted the "Create" permission by the root account or tag owner. For the specific permission model, see Members and Permission Management. References
Column-Level Permission Control