> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant a role access to a tag

> Grant a role access to a tag to control who can use the tagged data.

When you ingest data, you can either select or create a tag. A tag grants a role an access level
on every table and column that carries it, including ones tagged later.

For example, you can give the `nx1_engineer` role the **Read** level on a tag, so engineers can read
every table that carries that tag.

## Prerequisites

Before starting this task, ensure you have the following:

* Required roles: `nx1_migration_admin` or `nx1_migration_ops`.
* A Ranger tag service linked to NexusOne. Without it, the **Tag** option doesn't appear.

## Grant a role access to a tag

> [tab] Web portal
>
> Perform these steps to grant a role access to a tag.
>
> 1. Log in to NexusOne.
>
> 2. On the top navigation bar, hover your mouse over **Govern** and then select **Data Access**.
>
> 3. Click the **Grant access** tab.
>
> 4. Under **Who**, in the **Groups** field, select the role to give access to. Roles appear as groups.
>
> 5. Optional: In the **Users** field, select the users to give access to.
>
> 6. Under **On what**, click **Tag**.
>
> 7. In the **Tag** field, select the tag.
>
> 8. Under **Access level**, select the level to grant. For what each level includes, refer to
>    [Access levels](https://docs.nx1cloud.com/documentation/govern/overview.md#access-levels).
>
> 9. Optional: Under **Conditions**, in the **Hide the values of tagged columns** field, select one of the following:
>
>    * **Custom**: Applies a custom masking expression from Ranger.
>    * **Don't hide**: Shows the values.
>    * **Hash**: Replaces the value with its hash.
>    * **Nullify**: Replaces the value with null.
>    * **Partial mask: show first 4**: Hides all but the first four characters.
>    * **Partial mask: show last 4**: Hides all but the last four characters.
>    * **Redact**: Replaces the value with a placeholder character.
>    * **Unmasked**: Keeps the original value.
>
> 10. Optional: In the **Why** field, enter who asked for the access and what it is for.
>
> 11. Click **Preview** to see the policies the grant writes and whose access changes.
>
> 12. Click **Apply**.

> [tab] CLI
>
> Use the [`nx1 tags`](https://docs.nx1cloud.com/cli-reference/nx1/tags) command to get tags on DataHub.

> [tab] REST API
>
> Use the following API endpoints to:
>
> * [Get tags on DataHub](https://docs.nx1cloud.com/api-reference/endpoints/metastore/get-tags.md).
> * [Preview a grant](https://docs.nx1cloud.com/api-reference/endpoints/data-access/preview-a-grant:-the-policies-it-writes-and-whose-access-changes.md).
> * [Apply a grant](https://docs.nx1cloud.com/api-reference/endpoints/data-access/apply-a-grant.md) with a tag as the target.

## Additional resources

* For an overview of the Govern feature, refer to [Govern Overview](https://docs.nx1cloud.com/documentation/govern/overview.md).
* You can also grant this access directly in Ranger. For the steps, refer to
  [Create a policy](https://docs.nx1cloud.com/platform-components/apache-ranger/ranger-hands-on-examples.md#create-a-policy).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.