How do I assign permissions to a tag or a category using powercli? What is the object nomenclature?

[eric_silberberg]

How do I assign permissions to a tag or a category using powercli? What is the object nomerclature to assign to – entity?
I'm trying to script the assignment of a role to an active directory group and the target object is a category and/or a tag.
I'm assigning the read-only role to a category for backups. I'm assigning it read-only with no propagation. I'm having trouble finding the specific syntax for the entity when a tag or category are my intended objects. I've tried using a variable as well. Is this something sneaky where I need to be connecting to the inventory service or using a view instead of addressing the object directly?
My intended syntax is
new-vipermission -entity object for Category ImageLevelBackup -Principal active directory group. -role ReadOnly
new-vipermission -entity object for tag for a certain backup schedule -Principal active directory group. -role taguser
I have tried with a variable
$PermObject=get-tagcategory -Name ImageLevelBackup
get-vipermission -entity $PermObject
error Invalid object is specified for the Entity parameter - 'TagCategoryCisImpl'. Entity accepts only
InventoryItem objects and string.
Back to the question, what would the inventory object be for a category or a specific tag?

I have tried a get-vipermission on my vm to see what the syntax may be and only the vm type roles apply.

get-tag erictobackup

Name Category Description
---- -------- -----------
erictobackup ImageLevelBackup

Get-TagCategory ImageLevelBackup

Name Cardinality Description
---- ----------- -----------
ImageLevelBackup Single

[eric_silberberg]

The context is setting up Image Level backups with Avamar. Our backup admin has 6 windows per team. TeamBackupWindow1-6. We have about 8 teams currently, therefore 48 tags in category ImageLevelBackup

Tags

• ImageLevelBackup\Team1BackupWindow1

• ImageLevelBackup\Team1BackupWindow2

• .

• .

• ImageLevelBackup\Team2BackupWindow1

I have the 'Assign or Unassign vSphere Tag' privilege assigned to the appropriate active directory group as part of our regular virtual machine user role

We are doing read-only no propagation on the category so that the various teams can see the tags to choose the appropriate backup window to assigned to the individual virtual machine. We don't want them seeing all values so that they don't inadvertently place their machine into somebody else's backup, as well as keep list nice and short.

Then have a role with the singular privilege Assign or Unassign vSphere Tag assigned to the appropriate active directory group and the individual tags for that units backup windows.

[LucD]

Afaik there is currently no public API to interact with Global Permissions, which are the permissions used on Tags and Tag Categories.