> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/saas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/saas/configuration/tags.md).

# Manage Data Metadata

This section includes guidance for connecting and managing data metadata, which is used by Immuta to identify data targeted by policies.

<figure><picture><source srcset="/files/hkVLtWUShwkzQRzQCMDe" media="(prefers-color-scheme: dark)"><img src="/files/uxGkOgE5YmdHOtI4Wq7I" alt="Once your external data catalog tags, identification tags, and classification tags are applied to your data sources, you can use those tags to author policies to protect your data."></picture><figcaption></figcaption></figure>

## Entity and classification tags

Tagging your data sources and columns allows you to decouple policy logic from referencing physical tables or columns when authoring a policy. Immuta divides tags into two broad categories: **Entity tags**, which describe facts about the contents of individual columns in isolation, and **classification tags**, which describe the sensitive contents of a table with the context of all its columns. In Immuta, entity tags and classification tags are [applied automatically](#user-content-fn-1)[^1] to your data by [data identification](/saas/configuration/tags/data-discovery.md) and [data classification](/saas/configuration/tags/data-classification.md), respectively.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Identification: entity tags</strong></td><td><ul><li>Describe content.</li><li>Do not require subjective decisions.</li><li>Don't indicate how sensitive the data is.</li><li><p>Examples</p><ul><li>Column <code>ssn</code> has column tag <code>social security number</code></li><li>Column <code>l_name</code> has column tag <code>name</code></li><li>Column <code>dob</code> has column tags <code>date</code> and <code>date of birth</code></li></ul></li></ul></td></tr><tr><td><strong>Classification: classification tags</strong></td><td><ul><li>Describe sensitivity of content.</li><li>Require subjective decisions about context.</li><li>Indicate the sensitivity level of the data.</li><li><p>Examples</p><ul><li>Column <code>ssn</code> has column tag <code>PII</code></li><li>Column <code>l_name</code> has column tag <code>sensitive</code></li><li>Column <code>dob</code> has column tag <code>indirect identifier</code></li></ul></li></ul></td></tr></tbody></table>

Data identification and classification work together to describe the content of your data and the sensitivity of that data in context. For example, under the HIPAA framework a list of procedures a doctor performed is only considered protected health information (PHI) if it can be associated with the identity of patients. That means that&#x20;

1. If procedure codes appear in a table that **contains** patient identity information, those codes are PHI.&#x20;
2. If procedure codes appear in a table that **does not contain** any patient identity information, those codes are not PHI.&#x20;

Since identification (entity tagging) operates on a column-by-column basis, it can’t reason whether or not a column containing procedure codes merits classification as PHI and will not tag procedure codes as PHI. However, classification (classification tags) will tag the column PHI if it detects patient identity information in the other columns of the table.

Classification tags also carry a sensitivity level. For example, identification may tag a column that contains telephone numbers, but that entity tag alone cannot say that the column is sensitive. Instead, classification must determine the sensitivity level using the context of other columns: A phone number associated with a person may be tagged as sensitive, for example, while the publicly-listed phone number of a company would not be tagged sensitive.

## Using tags in policies to enforce access controls

Because identification does not contextualize column contents with neighboring columns' contents, using entity tags applied by identification alone prevents you from being able to author scalable policies using higher level classifications like "Tag all PII" or "Mask all columns tagged `classified`." Pairing identification with classification helps solve this issue. The [implement entity and classification section](#implement-entity-and-classification-tagging) below provides specific guidance for managing and using data metadata in policies, but in general you should

* Use identification to **automatically apply entity tags** to your data.
* Use classification frameworks to **automatically apply classification tags** to your data to provide higher-level context.
* **Target classification tags in policies** to create more scalable and generic policies. For example, instead of building a policy like “Allow access to tables with columns tagged `person name` and `phone number`,” build a policy that says “Allow access to tables with columns tagged `PII`.”

## Implement entity and classification tagging

{% stepper %}
{% step %}
**Apply entity tags**

There are several options for applying entity tags to data:

1. [**Identification (recommended)**](/saas/configuration/tags/data-discovery/enable-sdd.md): Immuta automatically discovers and tags your sensitive data with entity tags, and you can extend what types of entities are discovered to those specific to your business. This saves the time of identifying your data manually and provides the benefit of a standard taxonomy across all your data sources in Immuta. &#x20;
2. [**Tags from an external source**](/saas/configuration/tags/catalogs/configure.md): You may have already done all the work tagging your data in some external catalog or your own homegrown tool. If so, you can connect your existing data catalog to Immuta to pull your tags into Immuta. Once the catalog has been connected, Immuta ingests tags from the catalog and applies data source and column tags directly to the registered data source. See the [Support matrix](/saas/releases/support-matrix.md#external-catalogs) for a list of the supported external catalogs.&#x20;
3. [**Manually tag**](/saas/configuration/tags/manage-tags/managing-tags.md): You can manually tag tables and columns in Immuta from [within the UI](/saas/configuration/tags/manage-tags/managing-tags.md), using the [Immuta API](/saas/developer-guides/api-intro/immuta-v1-api/configure-your-instance-of-immuta/tagging.md), or when registering the data.
   {% endstep %}

{% step %}
**Use classification frameworks to automatically apply classification tags**

[Create and activate a classification framework](/saas/configuration/tags/data-classification/how-to-use-a-built-in-classification-framework-with-your-own-tags.md) so that Immuta can automatically apply classification tags to your data. To classify your data, Immuta evaluates your data in two phases:

1. Identification runs to identify your data by content type. The data is discovered and evaluated by the identifier it matches and is tagged.
2. After identification applies entity tags, any activated classification frameworks run to apply classification tags. The data is classified by the rules within a framework and the tags currently applied to the column and table. Once the data is classified, it's tagged with special classification tags with additional metadata to denote its sensitivity.

Both phases of classification in Immuta can be customized to find and tag the data your organization cares about. After data is classified, classification tags can be used to [build policies](/saas/govern/secure-your-data/authoring-policies-in-secure.md) or [visualize sensitive data access in the audit dashboards](/saas/govern/detect-your-data/detection/detect-concept.md).
{% endstep %}

{% step %}
**Author policies**

[Author policies](/saas/govern/secure-your-data/authoring-policies-in-secure.md) that target classification tags to enforce access controls on your sensitive data.
{% endstep %}
{% endstepper %}

[^1]: You can manually apply entity tags to your data by configuring an external catalog or managing tags in Immuta. However, Immuta recommends using identification to do this automatically instead. See the [implementation](#implement-entity-and-classification-tagging) section below for more details.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://documentation.immuta.com/saas/configuration/tags.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.