# Datastore Tags Permissions

Source: https://userguide.qualytics.io/source-datastore/tags/deep-dive/permissions/

This page covers the roles and permissions required to assign and unassign tags on source datastores. For the full reference of user roles and how they compare, see [User Roles](https://userguide.qualytics.io/settings/access/users/roles/overview/). For the canonical matrix of every team-permission-gated action, see [Team Permissions Overview](https://userguide.qualytics.io/settings/access/teams/team-permissions/overview/).

## Permission Matrix

Datastore access is controlled by team permissions. The user also needs the **Member** role or above; **Admin** bypasses team restrictions.

| Action | Minimum team permission |
| --- | --- |
| View tags on an accessible datastore | Reporter |
| Assign or unassign datastore tags | Editor |
| Assign a tag name that does not exist yet | Editor, plus the **Admin** role |
| Assign a team tag | Editor, plus membership in the tag's team. The datastore must be assigned to that team |
| Run Profile or Scan filtered by tag | Editor |

## Key Details

- **Viewing tags** requires access to the datastore; assigning a tag does not grant access.
- **Assigning and unassigning tags** requires the **Editor** team permission or above in at least one of the teams the datastore belongs to. This is a team-level permission - the user must be a member of a team that has Editor access to the datastore.
- **Running operations filtered by tag** (scoping Profile/Scan to tagged containers) requires the **Editor** team permission or above. This is the same permission required to run any operation - the tag filter is part of the operation configuration, not a separate permission.
- **Admin** users bypass all team-level permission checks and can manage tags across all datastores regardless of team membership.

> **Info: Team Context**
>
> Permissions for assign/unassign are evaluated against the datastore's **team assignments**. A user with the Editor team permission must be in at least one team that the datastore belongs to. For more details on how teams work, see the [Team Permissions](https://userguide.qualytics.io/settings/access/teams/team-permissions/overview/) page.

## UI Behavior Without Permission

| Scenario | What the User Sees |
| --- | --- |
| User lacks the Editor team permission | The  button next to "Assign tags to this datastore" is **hidden** - the tag selector cannot be opened. Tags are displayed as read-only. |
| User has no team access to the datastore | The datastore is not listed - the user cannot see it at all. |

> **Info: Creating, Editing, or Deleting Tags**
>
> Creating, editing, and deleting tags are not specific to datastores. Admins manage every tag, and users whose team holds the **Editor** team permission manage that team's [team tags](https://userguide.qualytics.io/tags/deep-dive/team-tags/). Assigning a tag name that does not exist yet creates it as a **Global** tag, so it needs the **Admin** role. Members can assign only tags that already exist. For those permissions, see the [Tags](https://userguide.qualytics.io/tags/overview/) documentation.

> **Info: Full Permissions Reference**
>
> For the complete permissions and roles matrix across all Qualytics features, see the [Team Permissions](https://userguide.qualytics.io/settings/access/teams/team-permissions/overview/) page.

*Last updated: November 5, 2026.*