Tag manager security review

Security review is an optional approval step that sits between finishing a Tag Manager version and publishing it. Instead of one person building and publishing in a single action, one user prepares the version and a second, authorized user reviews it and decides whether it reaches the live site.

Security review is optional and disabled by default. To enable it for an app, contact your Netmera account manager. While it is disabled, Tag Manager behaves exactly as documented elsewhere in this guide and none of the elements below appear in the panel.

Why use it

Every Tag Manager publish injects JavaScript and other assets into the live site. Organizations with strict change-control or information-security policies — banks, fintechs, insurers, public institutions — usually require a second pair of eyes before anything reaches production.

With security review enabled:

• No version reaches the site without an explicit approval.

• Every published version carries a named approver.

• Every version keeps a full record of who requested, approved, or rejected it, and why.

• The approval cannot be bypassed: publish endpoints called directly are rejected while the flow is enabled.

Roles

Role	What it can do
Creator Any user with Tag Manager access	Creates tags, triggers, and variables, and sends versions to review. Forks and previews any version, including one waiting for review. Cannot publish directly — Approve, Reject, and Download Version are not visible.
Security Reviewer Approver	Everything a Creator can do, plus approving or rejecting the version waiting for review, and downloading any version file.

Assign the Security Reviewer role to at least one panel user before security review is enabled. Without a reviewer, versions sent to review cannot be approved and publishing stops.

The same Security Reviewer role also covers Web Personalization security review — one role is enough for both products.

Send a version to review

1

1) Build the version

Create or edit tags, triggers, and variables in Workspace as usual.

2

2) Preview

Validate that triggers fire and variables resolve before involving a reviewer.

3

3) Click Send to Review

When security review is enabled, the Publish button on the workspace page appears as Send to Review.

4

4) Add a version note

A side panel opens for the version note. Describe what changed and why — this is the note the reviewer reads, and it is included in the notification email.

5

5) Confirm

The version is snapshotted and moves to Waiting Review, and the panel opens Version History. All Security Reviewers receive an email.

Review a version

A Security Reviewer opens Review Actions either from the version detail page or from the Actions column in Version History.

• Approve — a publish note is entered, the standard publish flow runs, and the version becomes Live. If the publish fails, the version stays in Waiting Review, so there is no partly published state.

• Reject — a reject note can be entered, and the version becomes Rejected. A rejected version is not final: it can be edited and sent to review again.

Version statuses

Status	Meaning
Waiting Review	Submitted and waiting for a Security Reviewer decision.
Live	Approved and published to the site.
Rejected	Reviewed and declined. Can be edited and resubmitted.

If a live version exists, the version waiting for review is listed first and the live version second. If there is no live version, the version waiting for review stands alone at the top.

Audit trail

The version detail page records the full decision history:

• Review Requested by and date

• Version Note entered at submission

• Approved by and date, with the Publish Note — or Rejected by and date, with the Reject Note

Approved and Rejected fields appear only once a decision has been made.

Notifications

Event	Who is notified	What the email contains
Version sent to review	All Security Reviewers	Link to the version detail page and the version note
Version approved	The user who submitted it	Link to the version detail page and the publish note
Version rejected	The user who submitted it	Link to the version detail page and the reject note

Users without the Security Reviewer role receive no review notifications.

Download Version

Security Reviewers see a Download Version button on every version — Waiting Review, Live, or Rejected — and can download the version file for offline inspection or archiving. The button is not visible to other roles, or when security review is disabled.