Tags in automation rules let you target a group of vault accounts with a single transfer trigger, instead of selecting each vault account individually.

When you attach a tag to a set of vault accounts, any automation rule that points at that tag applies to every account carrying it. Vault accounts you tag later are covered on their next transaction, so you do not need to edit the rule each time your account structure grows.

Automation rules tag capabilities

An automation rule has three parts: a trigger (when), conditions, and an action (then). Tags apply to the trigger.

In the trigger's Source or Destination selector, a Tags tab appears next to Vaults, Exchanges, Fiat, and Whitelisted. Select a tag there to target every vault account that carries it. You can combine tags, Wallet Pools, and individual accounts in the same selection.

This replaces two earlier approaches:

Listing each vault account in the rule, which means one rule per account when accounts are numerous.
Entering a vault ID range, which works only when the accounts you want happen to occupy consecutive ID numbers.

Supported tag types

Automation rules support:

Protected Tags: tags whose attach and detach actions require quorum approval.
Wallet Pools: a type of Protected Tag that also distributes outgoing transactions across the vault accounts in the pool.

Automation rules do not support unprotected vault tags. Because a tag defines which accounts a rule acts on, changing that group is a governed action, and only Protected Tags carry the approval controls this requires.

Before you begin

You need:

Permission to create tags and attach them to vault accounts in your workspace.
A quorum approval for each attach or detach action on a Protected Tag. Attach and detach have their own approval group, separate from the group that approves tag edits and deletions.

Create a tag and attach vault accounts

Navigate to Settings > Tags. If your workspace uses the new sidebar, navigate to Utilities > Tags.
Select Create Tag.
Enter a name, then set the tag type to Protected Tag. Creating a tag does not require approval.
Select the Accounts page and then the Vault tab.
Find a vault account you want to include, open its Tags column, and select +.
Select the tag you created, then submit the attach request for quorum approval.

Repeat steps 5 and 6 for each vault account in the group. When the approval completes, the accounts carry the tag and any rule pointing at that tag covers them.

Add a tag to an Automation rule

Open Automations and create a rule, or edit an existing one.
In the When step, select a transaction trigger.
Open the trigger's Source or Destination selector.
Select the Tags tab.
Select the tag or Wallet Pool you want the rule to cover. To include specific accounts as well, select them from the other tabs in the same selector.
Set the rule's conditions and action, then save the rule.

Example: sweep deposits into an omnibus account

A common use is moving incoming client deposits into a single omnibus vault account as they arrive.

Attach a Protected Tag, for example Clients, to every client deposit vault account.
Create an automation rule with a transaction trigger, and set the trigger's Destination to the Clients tag. The rule now runs whenever a deposit reaches any tagged account.
In the Then step, set the source to Inherited Account. This moves funds out of the account that triggered the rule rather than a fixed account.
Set the destination to your omnibus vault account.

One rule covers every client account. When you open a new client vault account and attach the Clients tag, the sweep applies to it without a rule change.

Note: When a balance condition uses Inherited destination accounts, you set its threshold as a USD value rather than in the asset's native units. This comes from the balance condition, not from the tag.

Resolving a tag when a rule runs

When a transaction involves a vault account that carries the tag, Fireblocks:

Resolves the tag to the set of vault accounts currently carrying it.
Matches the transaction against the rule's trigger.
Evaluates the rule's conditions.
Runs the action against the account that triggered the rule.
Records an automation run for the evaluation.

Because the tag is resolved when the rule runs, the rule always uses the current membership of the group. You do not need to enable anything for this. A vault account you tag today is covered on its next transaction.

Important: If you delete a tag that an active rule references, the rule shows an error. Update the rule to point at a different tag, or remove the tag from the trigger, before deleting the tag.

Set a tag through the API

You can also set a tag on a trigger through the automations API. In the trigger's source or destination, use the TAG account type and pass the tag's ID:

{ "type": "TAG", "tags": [{ "tagId": "<your-tag-id>" }] }

You can combine tag entries with specific accounts and vault account ranges in the same source or destination.

Limitations

Transaction triggers only. You can target a tag from a transaction trigger. Scheduled triggers that target a tag are not yet available.
Tags select the trigger, not the action. A tag defines which accounts cause a rule to run. The action still resolves to an account, which is what Inherited Account is for.
Protected Tags only. Unprotected vault tags cannot be used in automation rules.

Use tags in automation rules