---
title: About access tags
slug: about-access-tags
docTags: 
createdAt: 2026-07-21T14:43:46.206Z
---

# Tag-based access control

Using conditions and a set of tag variables, you can add a policy to scope access based on the tags that have been applied to a resource. Access can be controlled based on a tag that exists on the resource. Tag-based access control provides additional flexibility to your policies by allowing you to define access policies with tags.

:::hint{type="info"}
- Access tags are visible account-wide in all Kyndryl Bridge Services; avoid using personal information.
- Access tags must always be in the `key:value` format. Think of it as a string to isolate two logical parts. For example, *project\:projectname*. The Kyndryl Bridge Access Management user interface (UI) makes this distinction very clear.
- Access tags, both key and value, are case sensitive.
:::

# What is a resource?

A resource is any item that is created or owned by an application, such as Virtual Machines (VM), orders, and provider connections.

# What is a resource group?

A resource group helps you organize your resources in a way that best fits within your business. With resource groups, you can quickly grant users access to one or more resources at the same time. So, a resource group is a group that contains one or more resource attributes that maps to a collection of similar resources.

# What is an attribute?

An attribute is an element or metadata of the resource that helps identifying the resources, such as AssetID, OrderID, virtual machine in a specific region or virtual machine of a given provider.

# Use case: Assigning access tags in policy authoring

Access tags are designed for integration with ABAC. When authoring an access policy: 

- You can define policies like: 
  - **Allow access to resources where Project=Finance** 
  - **Deny access if Environment=Prod** 
- Tags can be used across users, access groups, and service identities for granular access control.