Name one accountable owner for the tag program, usually in marketing operations or web engineering, and make security and privacy reviewers for specific steps. Without a named owner, tags have no owner, because each team assumes another one is watching. A small RACI table fixes that in an afternoon.
The problem
Marketing asks for a tag. Engineering is busy. Security hears about it late. Privacy hears about it after launch. OWASP's third party JavaScript guidance describes a joint practice it calls MarSecOps, where marketing, vendors and operations coordinate on SRI hash updates, tag manager configuration and data layer changes. A RACI is how you make that coordination concrete.
R means responsible for doing the work. A means accountable, the one person who answers for the result. C means consulted before. I means informed after.
A starting RACI
| Activity | Marketing ops | Web engineering | Security | Privacy or legal |
|---|---|---|---|---|
| Request a new tag | A, R | C | C | C |
| Vendor review and contract | C | C | R | A |
| Build the tag in the container | R | C | I | I |
| Review the version diff | C | R | A | I |
| Publish to production | R | C | I | I |
| Manage Publish and Admin access | C | R | A | I |
| CSP and header policy | I | A, R | C | I |
| Consent behavior testing | R | C | I | A |
| Quarterly audit | R | C | A | C |
| Incident response for a bad script | C | R | A | C |
| Offboarding an agency | R | C | A | I |
Adjust it to your team. The important parts are that every row has exactly one A, and that the person who publishes is not the only person who reviews.
How to introduce it
- Draft the table with the people in the room. Cross out what does not fit.
- Put it next to your tag request form.
- Pick the A for the program as a whole. That person owns the inventory.
- Agree a response time for reviews, so marketing does not wait weeks.
- Revisit after a quarter, using the audit checklist.
Keeping speed
The common fear is that review slows campaigns. Reduce that cost by pre approving low risk patterns, such as built-in templates on public pages, and reserving review for custom code, new vendors and sensitive pages. See which pages should not run marketing tags for a page based split.
Incidents
When a vendor script is compromised, speed matters. The responsible person should be able to pause the tag within minutes, which means at least two people with Publish and a documented way to do it. Rehearse once. The third party vendor breach communication guide helps with the customer side.
Quick check
Who should be accountable for tags?
One named person for the program, often in marketing operations or web engineering, with security accountable for review and access.
Does every team need to approve every tag?
No. Pre approve low risk patterns and route custom code, new vendors and sensitive pages to review.
Where Safeguard fits
Safeguard's policies, gates and compliance and evidence automation can support the review and record keeping parts of this table for code. Try the free scan.
Sources
Last reviewed: 19 October 2026.
