Tags are custom labels you can attach to vault accounts to classify, filter, and manage your vault inventory at scale. Support for additional Fireblocks entity types is planned for future releases.
Fireblocks offers two types of tags:
- Standard tags: Flexible, general-purpose labels for organizing and filtering vault accounts. No approval required.
- Protected tags: Labels with policy enforcement enabled. They can be referenced in Policy rules, and all changes require quorum approval.
Comparison
| Standard tags | Protected tags | |
| Attach to vault accounts | Yes | Yes |
| Use in Policy rules | No | Yes |
| Changes require approval | No | Yes |
| Who can manage | All roles | Owner, Admin, Non-Signing Admin, Editor |
| Takes effect | Immediately | After Owner approval |
When to use each type
Use standard tags when you want to:
- Organize vault accounts by region, environment, team, or business unit
- Filter vault accounts quickly in the Console or via API
- Keep your vault inventory structured without any governance overhead
- Label vaults for reporting, reconciliation, or operational clarity
Use protected tags when you want to:
- Reference vault groupings directly in Policy rules
- Enforce consistent controls across vault groups (approvals, restrictions, allowlists)
- Ensure that changes to vault group membership go through a formal approval process
- Build tag-based automation and advanced business workflows
How they work together
Standard and protected tags are not mutually exclusive. A vault account can have both at the same time, up to a combined maximum of 20 tags. A common pattern is to use standard tags for operational labeling (for example, Europe, Hot Wallet, Testnet) alongside protected tags for policy enforcement (for example, High-Risk, Treasury, Whitelisted).
Quick start
To get started with tags:
- In the Fireblocks Console, go to Settings > Tags (Utilities > Tags in some workspaces).
- Select Create tag.
- If you want to create a protected tag, select the Protected tag checkbox. Otherwise, leave it blank.
- Attach the tag to vault accounts by selecting + in the Attachments column, or by going to Accounts > Vault.
With protected tags, you have to submit a request to attach them to a vault account. After approval, you can use the protected tag in your Policy rules.