The tags_admin role does not see all tags on task records with tags - Known Error

The tags_admin role does not see all tags on task records with tags Description A tags_admin user can not see tags on records (incidents, problems, tasks, etc.) if not added via a user group, or as a user, and allowed to see, even though already able to manage tags.

Steps to Reproduce

1. Go to incident.list. 2. Click on the Update Personlized list and add "Tags" to the list. 3. Create a tag and name it asset. 4. Go to sys_user.list. 5. Open user record (aileen.mottern). 6. Go to the Roles related list tab, click Edit, add tags_admin and itil, and click Save. 7. Go to the Groups related list tab, click Edit, add Application Development or some other group that is non-admin, and click Save. 8. Impersonate user Aileen.Mottern to verify the tags_admin behavior. 9. Go to incident.list. 10. Filter Tags = asset and click Run. Notice the tag is not visible to the tags_admin. 11. As Admin, go to label.list and open the asset tag. 12. Change "Viewable by" to Groups and Users, and click Update. 13. Switch back to Aileen.Mottern and go to incident.list with the filter on asset tag. Notice you still can not see the tag. 14. As Admin, go back to the label.list. 15. Open asset tag and add Application Development group to the tag. Click Update. 16. Switch back to Aileen.Mottern and go to incident.list with the filter on asset tag. Notice you can now see the tag.

The tags_admin can not see tags unless they are given explicit rights to see it. Also, tags can be filtered on by tags_admin even if they can not be seen. NOTE: Setting the "Viewable by" to Everyone, anyone can see the tag.

Admin users are also unable to view other users' tags on records, unless the tag is marked Viewable by "Everyone" or the admin is given explicit permission to view the tag. This can be confirmed by the following steps:

17. As System Administrator, create a new table with the label "Testing Admin Tags." Before clicking "submit", go to the controls tab and copy the User role (in this case it should be something like "testing_admin_tags_user"). 18. Navigate to sys_user.list and click on the user "Abraham Lincoln." Under the "Roles" tab, click edit and give Abraham Lincoln the "tags_admin" role and the role copied in previous step. 19. Impersonate Abraham Lincoln and navigate to the Testing Admin Tags table. Create a new record on the table and press Submit. 20. Click on the newly created record. Click on the button with three circles on the upper right of the screen. Click on the "Add Tag" option and create a tag called "My Tag". 21. Navigate to the label.list table. Click on the record of the newly created tag (My Label). 22. Set the "Viewable by" tab to Groups and Users. Click Update. 23. Impersonate System Administrator and navigate back to the record created in step 19. 24. Click on the button with three circles on the upper right of the screen and confirm that the "My Label" tag is not viewable.

Workaround This is expected behaviour. Tag admins should not be able to view personal tags on specific records unless given specific permission to do so. Since the System Administrator can not view the personal tags on records, the tags_admin should also not be able to view personal tags.

However, if needed, the tag_admin can give itself permission to view any tag by navigating to the label.list table and setting explicit permission in the "Viewable by" field. A business rule can also be created to give tag_admins permission to each tag. System administrators can also give themselves permission to view tags on records using the same steps.