Tag Data Assets in Catalog Explorer

1.What a tag is and what you can tag

A tag in Unity Catalog is a key with an optional value. You attach it to a securable object to organize and categorize it. Tags also do practical work: tag keys and values are searchable from the workspace search bar, so a well-chosen tag helps other analysts find the table they need. One detail matters when you write search terms: tag search requires exact term matching.

You can tag far more than tables. Securable-object tagging covers catalogs, schemas, tables, table columns, volumes, views, functions, registered models, model versions, external metadata objects and services. Dashboards, Genie Agents, Databricks apps and notebooks can be tagged too, but each has its own page for doing so.

Sources1

2.Adding a tag in Catalog Explorer

Before you open the UI, check that you have permission. To add tags to a securable object, you must either own the object or hold all three of these privileges: APPLY TAG on the object, USE SCHEMA on its parent schema, and USE CATALOG on its parent catalog. APPLY TAG alone is not enough. You also need to be able to reach the object through its schema and catalog.

The UI path is short. Click Catalog in the sidebar and select the object. On its Overview page, find the Tags area. If the object has no tags yet, click the Add tags button. If it already has some, click the Add/Edit tags icon. Then choose an existing tag key and value, or type the name of a new tag. The picker groups tags into two sections. Governed tags appear under a Governed header with a lock icon, and everything else appears under Other. An Include system tags toggle shows or hides system tags.

Sources1

3.Governed tags, system tags and the certification badge

Not every tag in the picker behaves the same way. A governed tag is an account-level tag with a tag policy. The policy defines the allowed values and controls which users and groups can assign the tag. Two things change for the person applying it. First, the value must come from the policy's list. Second, you need the ASSIGN permission on that governed tag in addition to the normal tagging privileges. Deleting a governed tag does not remove it from objects. The assignments stay in place but become ungoverned, so anyone can modify them without the extra permission.

System tags are a special type of governed tag whose keys and values are predefined by Databricks. Users cannot modify or delete them, but governed tag permissions still control who can assign them. For a data analyst, the most important one is system.certification_status. It has exactly two values: certified, meaning the asset meets internal standards for accuracy, completeness and trust, and deprecated, meaning it is outdated and should not be used in new work. The badge appears next to the object's name, and the tag affects how the data appears in notebooks and the SQL editor.

Sources123

4.Tagging with SQL, and the limits that apply

Anything you can do in the Tags area of the UI you can also do in SQL. On Databricks Runtime 16.1 and above, the SET TAG and UNSET TAG statements manage tags on securable objects. The example below tags a catalog with a cost center.

SET TAG ON CATALOG catalog `cost_center` = `hr`;

On Runtime 13.3 and above, the older form is an ALTER statement with a SET TAGS or UNSET TAGS clause. The documentation uses it to put a governed tag on a single column:

-- Add the governed tag to ssn column
ALTER TABLE abac.customers.profiles
ALTER COLUMN SSN
SET  ?  ('pii' = 'ssn');

Whichever method you use, the same constraints apply. Tag keys are case sensitive, so Sales and sales are different tags. An object can carry at most 50 tags, and a table can have at most 1,000 column tags across all its columns. Keys and values are limited to 256 characters each, and neither may have leading or trailing spaces. Keys cannot contain the characters . , - = / : . You also cannot tag several columns in one ALTER TABLE command; each column needs its own statement. COMMENT is different here, because it does accept several columns at once. To read tags back, query the INFORMATION_SCHEMA views CATALOG_TAGS, SCHEMA_TAGS, TABLE_TAGS, COLUMN_TAGS and VOLUME_TAGS.

The documentation gives a fixed order for this, meant to prevent potential data leaks. First remove the tag with UNSET TAG ON COLUMN, then drop the column with ALTER TABLE ... DROP COLUMN. Dropping the column does not by itself erase the data, because time travel might still expose it. To delete the data permanently, follow the separate Drop columns procedure. Foreign tables are the one exception: their column tags are dropped automatically when the column is dropped in the foreign source.

Sources1

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.Deleting a governed tag removes that tag from every object that carried it.Why is that wrong?

   The tag assignments stay on the objects but become ungoverned, so anyone can then modify them without the governed-tag permission.

   Covered in Governed tags, system tags and the certification badge

2. 2.Tag keys are case-insensitive, so 'Sales' and 'sales' are the same tag.Why is that wrong?

   Tag keys are case sensitive, and those two keys are distinct tags.

   Covered in Tagging with SQL, and the limits that apply

3. 3.Like COMMENT, one ALTER TABLE statement can set tags on several columns at once.Why is that wrong?

   Each column must be tagged separately. COMMENT is the clause that accepts multiple columns.

   Covered in Tagging with SQL, and the limits that apply