[Access] Document tag permissions for targets with Access for Infrastructure (#33676)

* [Zero Trust] Document tag permissions for infrastructure targets

Author: asamborski

src/content/changelog/cloudflare-one/2026-10-01-infrastructure-target-tag-permissions.mdx

@@ -0,0 +1,14 @@
+---
+title: Simplified permissions for tagging targets with Access for Infrastructure
+description: Tag targets with only the Zero Trust Write API token permission.
+date: 2026-10-01
+products:
+  - cloudflare-one
+  - access
+---
+
+You can now tag [targets](/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets) using only the `Zero Trust Write` API token permission. Previously, tagging targets through the API required both `Zero Trust Write` and `Tag Write` permissions on the API token.
+
+This change applies to inline target tagging through the [Infrastructure Access Targets API](/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/). Tagging resources through the general [Resource Tagging API](/resource-tagging/) still requires the `Tag Admin`, `Tag Write`, or equivalent role.
+
+For more information, refer to [Tag targets](/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets).

src/content/docs/cloudflare-one/access-controls/applications/non-http/infrastructure-apps.mdx

@@ -11,7 +11,14 @@ tags:
 - Authentication
 ---
 
-import { Badge, Details, Tabs, TabItem, Render } from "~/components";
+import {
+	APIRequest,
+	Badge,
+	Details,
+	Tabs,
+	TabItem,
+	Render,
+} from "~/components";
 
 <Details header="Feature availability">
 
@@ -164,6 +171,34 @@ To view all available filters, type `warp-cli target list --help`.
 
 To revoke a user's access to all infrastructure targets, you can either [revoke the user from Zero Trust](/cloudflare-one/access-controls/access-settings/session-management/#per-user) or revoke their device. Cloudflare does not currently support revoking a user's session for a specific target.
 
+## Tag targets
+
+Attach key-value [resource tags](/resource-tagging/) to targets to organize and filter them or build [target criteria](#target-criteria) for your applications.
+
+To tag a target, you need an API token with the `Zero Trust Write` [permission](/fundamentals/api/reference/permissions/). No additional tag-specific permissions are required.
+
+To add tags to a target, make a `PUT` request to the [Infrastructure Access Targets](/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/update/) endpoint. Include a `tags` object:
+
+<APIRequest
+	path="/accounts/{account_id}/infrastructure/targets/{target_id}"
+	method="PUT"
+	json={{
+		hostname: "infra-target-example",
+		ip: {
+			ipv4: {
+				ip_addr: "198.51.100.10",
+				virtual_network_id: "c77b744e-acc8-428f-9257-6878c046ed55",
+			},
+		},
+		tags: {
+			environment: "production",
+			team: "platform",
+		},
+	}}
+/>
+
+Each target supports one value per tag key. For more information on managing tags, refer to [Resource Tagging](/resource-tagging/how-to/manage-tags/).
+
 ## Granular target permissions
 
 Infrastructure Access supports granular read permissions through [Cloudflare's role-based access control](/fundamentals/manage-members/roles/). Administrators can assign read-only roles scoped to specific targets instead of granting account-wide access. When a user with a scoped role calls the targets list API, the response is automatically filtered to only include the targets they have permission to view.