## Protect data by tag (purpose)

URL: https://docs.atlan.com/product/capabilities/governance/access-control/how-tos/create-a-purpose

> Create a purpose in Atlan to scope access by asset tag. Pick one or more tags, attach policies, and protect every asset that carries those tags now and in the future.

Create a purpose to scope access by asset tag: useful for protecting PII, confidential financial data, or any sensitivity-tagged asset. You pick one or more [tags](https://docs.atlan.com/llms/governance/tags/what-are-tags/llms.txt), and Atlan treats every asset carrying any of those tags as part of the purpose. Attach metadata and data policies to control who can see, query, or modify those assets: including any future assets that get the tag.

## Prerequisites

Before you create a purpose, make sure:

- You are an **admin** in Atlan, or you have the **Governance Admin** [sub-role](https://docs.atlan.com/llms/governance/access-control/delegate-administration/llms.txt).
- The **tags** you want to associate with the purpose already exist. A purpose needs at least one tag: if yours doesn't exist yet, [create it first](https://docs.atlan.com/llms/governance/tags/create-a-new-tag/llms.txt).
- You know which users or groups the purpose's policies will govern, and what permissions you want to grant or deny.

## Create purpose

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, from the left menu, click **Admin**.

2. Click **Purpose** to open the purposes list.

3. Click the **Get started** button (if this is your first purpose) or the **New Purpose** button in the top right (if you already have purposes).

4. Enter a meaningful **name** for the purpose, and optionally a description.

5. In the lower-left corner of the dialog, click **Select tag**. Select one or more tags from the list: every asset carrying any of these tags becomes part of the purpose's scope. Click anywhere outside the list to close it.

6. Click **Create** to save. You now have a purpose linked to the selected tags. It doesn't restrict access yet: you'll add policies in the next section. Users can already use the purpose to browse all tagged assets as a virtual collection.

## Add policies

A purpose without policies acts only as a virtual collection driven by tags. To actually grant or restrict access, attach one or more policies. Repeat the steps for each set of users and permissions you want to control.

1. Inside the purpose, switch to the **Policies** tab.

2. Click **New Policy** and choose the type that fits what you want to control:

 - **Metadata policy**: grants or restricts permissions to change metadata on the tagged assets.
 - **Data policy**: grants or restricts permissions to query and preview data on the tagged assets.

### Add metadata policy

1. Choose **Metadata policy**.

2. Under _Name_, briefly describe the policy's intention: for example, *Block edits on PII columns*.

3. (Optional) Under _Users and Groups_, choose the users to whom the policy applies. By default, the policy applies to all users.

 - Click the **x** in the _Users and Groups_ box, then click the **Add** link.
 - Search for and select the users and groups, then click anywhere in the _Metadata policy_ sidebar to close the picker.

4. (Optional) Under _Configure permissions_, click **Edit** to choose which [permissions](https://docs.atlan.com/product/capabilities/governance/access-control/metadata-policy) the policy grants. By default, all permissions are granted. Hover over each checkbox to see what it controls.

5. (Optional) Under _Deny selected permissions_, choose whether the policy should **explicitly deny** these permissions instead of granting them.

 :::warning Deny overrides every grant

 If enabled, this deny overrides grants from any other policy for the same users: across every purpose AND persona they belong to.

 :::

6. Click **Save**.

### Add data policy {#add-data-policy}

1. Choose **Data policy**.

2. Under _Name_, briefly describe the policy's intention: for example, *Deny query on Confidential: Finance*.

3. (Optional) Under _Users and Groups_, choose the users to whom the policy applies. By default, the policy applies to all users. (Same Add / Search flow as the metadata policy.)

4. (Optional) Under _Querying Permissions_, choose whether the policy should **explicitly deny** the ability to query and preview data on the tagged assets.

 :::warning Deny cascades to the whole table

 A deny on data policies blocks query and preview at the table level. If even one column in a table carries the tag, querying or previewing the entire table is denied for users covered by this policy.

 :::

5. (Optional) Under _Masking (Optional)_, select a masking type to apply instead of a full deny: Atlan replaces the value of tagged columns with a masked output when the user queries or previews. Hover over each masking type to see a description and example.

6. Click **Save**.

## Add rich documentation (optional)

Document the purpose so other admins know why it exists and who owns it. Inside the purpose:

- Under _Summary → Channels_, add any Slack channels relevant to the purpose.
- Under _Resources_, add links to external resources: PDFs, repositories, Notion, Confluence, Google Drive, anything with a URL.
- Under _Readme_, write a richly-formatted description.

## Set preferences (optional)

Tailor the UI for users when they're browsing through the purpose: visible asset types, sidebar tabs, asset filters, and custom metadata.

1. Switch to the **Preferences** tab.

2. Adjust each category in the left menu:

 - **Asset types**: uncheck asset types to hide them.
 - **Asset sidebar**: uncheck [sidebar tabs](https://docs.atlan.com/llms/governance/access-control/configure-persona-preferences/llms.txt) to hide them.
 - **Asset filters**: uncheck filters to remove them from the discovery filters menu.
 - **Custom metadata**: uncheck [custom metadata structures](https://docs.atlan.com/llms/governance/custom-metadata/manage-custom-metadata-structures/llms.txt) to hide them.

## Need help?

If a purpose's policies aren't taking effect, check whether the assets actually carry the right tags and whether any other purpose or persona has a **deny** rule that wins over the grants. Contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) if the issue persists.

## Next steps

Now that the purpose exists, define its scope and reuse its policies:

- [Choose what to protect](https://docs.atlan.com/llms/governance/access-control/assign-tags-to-a-purpose/llms.txt): Add or remove the tags that decide which assets the purpose covers.
- [Copy a policy to another purpose](https://docs.atlan.com/llms/governance/access-control/copy-a-policy-to-another-purpose/llms.txt): Reuse an existing policy without rebuilding it.

---