vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Why can't I delete access management tags? 

If you can't delete an access management tag within an IBM Cloud® account that you're not the owner of, you might need to check the type of access you're assigned. Or, the tag might be attached to a resource.

  What’s happening 



*  You can't delete access management tags in an account of which you are a member.
*  You have the permission, but still unable to delete an access management tag.



  Why it’s happening 

The action might be blocked by one of the following reasons:



*  You might not be assigned the appropriate access to complete the action. You must have the Administrator role on the Tagging Service that is listed under the Account management services or Administrator role on all Account management services.
*  The access management tag you're trying to delete is still attached to an active or a reclaimed resource.



  How to fix it 

Complete the following steps to check your level of access. If you need to request access, contact the account owner.

Go to Manage > Access (IAM) in the IBM Cloud console, and select your name on the Users page.



*  To view IAM access policies that are assigned to you, select Access and view the Access policies table.
*  To determine what access you have through the access groups you are assigned, select Access and view the Access groups table. Check the access policies for each of the access groups.



To view what actions are mapped to each role, click the numbers listed next to each role.

Before you try to delete an access management tag, make sure it's not attached to any of your resources.



*  Filter by tag name on your [resource list](https://cloud.ibm.com/account/tags). If you don't have a viewer permission for all existing resources, contact the account owner to verify.
*  Use the ibmcloud resource reclamation command in the IBM Cloud® CLI to list out resources in reclamation state and delete the resource that had the tag you were trying to delete. For more information, see [Using resource reclamations](https://cloud.ibm.com/docs/account?topic=account-resource-reclamation).



When you delete an access management tag from the account, any associated IAM policies are also deleted with it.
Conveying Modified Source Versions You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:a) The work must carry prominent notices stating that you modified it, and giving a relevant date.b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.<-- </section "id="section-en-notice-convey-mod-source" "> --><-- <section "id="section-en-notice-non-source" "> --> 6.
Managing SSL certificates 

You can manage your SSL certificates in the IBM Cloud® console. Not only can this serve as a repository for management of your certificates, it is also necessary when using services that can use or require certificates.



1.  Navigate to your console's security menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=virtual-servers-navigating-devices).
2.  From the Security menu, select SSL > Certificates > Manage Certificates.



You are presented with a list of your current certificates, along with information regarding their status.

You can search, download parts of a certificate or a PEM formatted version, or review the expiration of your certificates. You can also view how many services are currently using each certificate. This lets you know whether action must be taken when a certificate is nearing expiration.



  Adding a certificate 

When you are ready to add a certificate, select Add Certificate in the sub-navigation menu or within the Certificate List title. You are only required to supply the certificate and its private key. However, not providing an intermediate certificate when your issuer provides one can result in a broken certificate chain and improper validation for users or associated services.

Private keys that require a passphrase cannot be stored.

Once added, the following fields are derived from your certificates directly:



*  Common name
*  Organization name
*  Validity period







  Editing a certificate 

Activating the triangle to the left of a certificate reveals the certificate parts in their entirety. This also allows the certificate parts to be edited. A note can be added, and when necessary the certificate can be removed. Also listed is a list of services that are currently using the certificate.

Only certificates that are not associated with services can have their private key, certificate, or intermediate certificate parts updated. The certificate also cannot be removed. You can modify the note at any time.





  Removing a certificate 

To remove a certificate, follow the steps to edit it and select Confirm certificate removal and save.





  Using the API 

For an example of editing certificates using the API, see [SSL Management ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](http://sldn.softlayer.com/article/ssl-management).
InvalidBucketName The specified bucket is not valid. 400 Bad Request 
 InvalidBucketState The request is not valid with the current state of the bucket. 409 Conflict 
 InvalidDigest The Content-MD5 that you specified is not valid. 400 Bad Request 
 InvalidLocationConstraint The specified location constraint is not valid. For more information about regions, see How to Select a Region for Your Buckets. 400 Bad Request 
 InvalidObjectState The operation is not valid for the current state of the object. 403 Forbidden 
 InvalidPart One or more of the specified parts might not be found. The part might not have been uploaded, or the specified entity tag might not have matched the part's entity tag. 400 Bad Request 
 InvalidPartOrder The list of parts was not in ascending order. Parts list must specified in order by part number. 400 Bad Request 
 InvalidRange The requested range cannot be satisfied. 416 Requested Range Not Satisfiable 
 InvalidRequest Please use AWS4-HMAC-SHA256. 400 Bad Request 
 InvalidSecurity The provided security credentials are not valid. 403 Forbidden 
 InvalidURI Mightn't parse the specified URI. 400 Bad Request 
 KeyTooLong Your key is too long. 400 Bad Request 
 MalformedPOSTRequest The body of your POST request is not well-formed multipart/form-data. 400 Bad Request 
 MalformedXML The XML you provided was not well-formed or did not validate against our published schema. 400 Bad Request 
 MaxMessageLengthExceeded Your request was too large. 400 Bad Request 
 MaxPostPreDataLengthExceededError Your POST request fields preceding the upload file were too large. 400 Bad Request 
 MetadataTooLarge Your metadata headers exceed the maximum allowed metadata size. 400 Bad Request 
 MethodNotAllowed The specified method is not allowed against this resource. 405 Method Not Allowed 
 MissingContentLength You must provide the Content-Length HTTP header. 411 Length Required
With the master key, you take the ownership of the cloud HSM and own the root of trust that encrypts the entire hierarchy of encryption keys, including root keys and standard keys in the key management keystore and Enterprise PKCS #11 (EP11) keys in the EP11 keystore. You need to configure the master key first before you can manage encryption keys. One service instance can have only one master key. If you delete the master key of the service instance, you can effectively crypto-shred all data that was encrypted with the keys that are managed in the service.





 Master key part 

If you initialize your service instance using key part files, or using smart cards together with the Management Utilities, a master key is composed of two or three master key parts. Master key parts that are created in Hyper Protect Crypto Services are symmetric 256-bit AES keys. For security considerations, each key part can be owned by a different person. Key parts are stored in workstation key part files when the [IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-tke-concept) is used to load the master key. Key parts are stored on [smart cards](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-smart-card-concept) when the [Hyper Protect Crypto Services Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-management-utilities-concept) are used to load the master key. The key part owner needs to be the only person who knows the file password or the smart card personal identification number (PIN) for the key part.





 IBM Cloud Trusted Key Entry CLI plug-in 

Trusted Key Entry (TKE) command-line interface (CLI) plug-in is a CLI plug-in working with IBM Cloud CLI. The TKE plug-in provides a set of functions for managing crypto units that are assigned to an IBM Cloud user account.
Check and make sure that the current master key register is in Valid state with [the current master key loaded](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsmload-master-keys), the new master key register is empty, and the crypto units of the service instance are not in imprint mode by running the following command:

ibmcloud tke cryptounit-compare
3. The new master key parts are prepared for rotation. For more information about how to create a new master key part, see [Create a set of master key parts to use](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsmstep4-create-master-key).







 Rotating master keys by using key part files 

To rotate the master key by using key part files on your workstation, follow these steps:



1. Load the new master key parts to the new master key register with the following command:

ibmcloud tke cryptounit-mk-load

To load a master key register, all master key part files and signature key files to be used must be present on a common workstation. If the files were created on separate workstations, make sure that the file names are different to avoid collision. The master key part file owners and signature key file owners need to enter the file passwords when the master key register is loaded on the common workstation.

A list of the master key parts that are found on the workstation is displayed.

When prompted, enter the master key parts to be loaded into the new master key register, the password for the signature key file to be used, and password for each selected key part file sequentially.

The new master key is now in Full uncommitted state in the new master key register.

To load a new master key, you need to enter at least two master key parts. Make sure that at least one master key part is not used for the current master key. Otherwise, the same master key is generated and you are not able to load it to the new master key register.
2. Commit the new master key with the following command:
* How can I manage user access to my service instances? Does IBM have access to my instances?

IBM or any third-party users do not have access to your service instances or your keys. By loading the master key to your service instance, you take the ownership of the cloud HSM and you have the exclusive control of your resources that are managed by Hyper Protect Crypto Services.

Hyper Protect Crypto Services follows the IBM Cloud Identity and Access Management (IAM) standard. You can [manage user access by assigning different IAM roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) and [grant access to specific keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-keys) to enable more granular access control.
* How does IBM offer a unique and secure process for service initialization (key ceremony)?

Hyper Protect Crypto Services sets up signature keys for crypto unit administrators during the service initialization process to ensure that the master key parts are loaded to the HSM with no interception.

A master key is composed of two or three master key parts. Each master key custodian owns one encrypted master key part. In most cases, a master key custodian can also be a crypto unit administrator. In order to load the master key to the service instance, master key custodians need to load their key parts separately by using their own administrator signature keys.

A signature key is composed of an asymmetric key pair. The private part of the signature key is owned by the crypto unit administrator, while the public part is placed in a certificate that is used to define an administrator and never leaves the crypto unit.

This design ensures that no one can get full access of the master key, even the crypto unit administrators.
* What is a 140-2 FIPS Level 4 Certification and how can I validate it?

The Federal Information Processing Standard (FIPS) Publication 140-2 is a US government computer security standard that is used to approve cryptographic modules.
You don't need to prepare a new master key for the rotation. The new master key is automatically generated in a recovery crypto unit and then propagated to the operational crypto units and other recovery crypto units. 
 Using key part files IBM Cloud TKE CLI plug-in The master key is composed of two or three master key parts that are stored on your local workstation files. The local files serve as a backup of the master key. You need to make sure that the files are properly saved and only the master key custodian knows the password. You need to prepare new master key parts on your local workstation before you can rotate the master key for your service instance. 



If smart cards are used to initialize the service instance, the recovery crypto units are not applicable and can be ignored. The backup of the master key relies on the backup of the smart cards in that case.



 Initializing service instances by using smart cards and the Management Utilities 

For the highest level of security, you can use smart cards together with the Hyper Protect Crypto Services Management Utilities to initialize the service instance. This approach uses smart cards to store signature keys and master key parts. Signature keys and master key parts never appear in the clear outside the smart card.



 Understanding the Management Utilities 

The Management Utilities are composed of two applications that use smart cards to configure service instances: the Smart Card Utility Program and the Trusted Key Entry (TKE) application. To use the Management Utilities, you need to [order IBM-supported smart cards and smart card readers](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilitiesorder-smart-card-and-reader) and follow the instructions in [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities).

The following diagram illustrates the relationship between various components when you use the Management Utilities to initialize a service instance.

Zoom

!
Classifying documents 

A document classifier machine learning model analyzes documents and tags them with the appropriate label from a set of labels that you define.

Classifying documents is useful when you want to sort many documents into groups programmatically. For example, you might have a collection that contains customer comments about products that you sell. If you can automatically sort the feedback into classes, you can isolate urgent issues that customers mention and tackle them first. Based on previous feedback, you might define classes such as the following labels:



* Not functioning correctly
* Features not as advertised
* Difficult to use
* Missing parts
* Parts shipped don't match parts list in assembly instructions



To create a document classifier, you build a machine learning model that can recognize which class best captures the point of customer feedback that is specified in natural language. You pair them with class labels that represent real scenarios that make sense for your business.

What's the difference between a document classifier and a text classifier?
: A document classifier can classify documents based on words and phrases extracted from the body text fields with information from their part of speech and the other enrichments that are applied to the body text taken into account. The information from the other non-body fields are also used. A text classifier can classify documents based on words and phrases extracted from the body text with their part of speech information taken into account. For more information about how to create a text classifier, see [Classifier](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-domain-classifier).



 Before you begin 

To train the document classifier model, you must provide sample documents that are labeled appropriately. Prepare the following files:

Training data
: Required. CSV file that is used to train the document classifier machine learning model. The file can contain key data points per column. The data points can vary, but the file must include the following columns:



* Natural language text that you want to classify or label.
* Label or class name that categorizes the idea that is expressed in the document text. You can apply more than one label to a text sample. Separate multiple label values with a semicolon.
FAQs: Security and compliance 

Read to get answers for questions about data security in IBM Cloud® Hyper Protect Crypto Services.



 How can I manage user access to my service instances? Does IBM have access to my instances? 

IBM or any third-party users do not have access to your service instances or your keys. By loading the master key to your service instance, you take the ownership of the cloud HSM and you have the exclusive control of your resources that are managed by Hyper Protect Crypto Services.

Hyper Protect Crypto Services follows the IBM Cloud Identity and Access Management (IAM) standard. You can [manage user access by assigning different IAM roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) and [grant access to specific keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-keys) to enable more granular access control.





 How does IBM offer a unique and secure process for service initialization (key ceremony)? 

Hyper Protect Crypto Services sets up signature keys for crypto unit administrators during the service initialization process to ensure that the master key parts are loaded to the HSM with no interception.

A master key is composed of two or three master key parts. Each master key custodian owns one encrypted master key part. In most cases, a master key custodian can also be a crypto unit administrator. In order to load the master key to the service instance, master key custodians need to load their key parts separately by using their own administrator signature keys.

A signature key is composed of an asymmetric key pair. The private part of the signature key is owned by the crypto unit administrator, while the public part is placed in a certificate that is used to define an administrator and never leaves the crypto unit.

This design ensures that no one can get full access of the master key, even the crypto unit administrators.





 What is a 140-2 FIPS Level 4 Certification and how can I validate it? 

The Federal Information Processing Standard (FIPS) Publication 140-2 is a US government computer security standard that is used to approve cryptographic modules.
You can recover your master key from the backups if the master key is lost or destroyed. You don't need to prepare a new master key for the rotation. The new master key is automatically generated in a recovery crypto unit and then propagated to the operational crypto units and other recovery crypto units. 
 Using key part files IBM Cloud TKE CLI plug-in The master key is composed of two or three master key parts that are stored on your local workstation files. The local files serve as a backup of the master key. You need to make sure that the files are properly saved and only the master key custodian knows the password. You need to prepare new master key parts on your local workstation before you can rotate the master key for your service instance. 



If smart cards are used to load the master key, the recovery crypto units are not applicable and can be ignored. The backup of the master key relies on the backup of the smart cards in that case.



 Initializing service instances by using smart cards and the Management Utilities 

For the highest level of security, you can use smart cards together with the Hyper Protect Crypto Services Management Utilities to initialize the service instance. This approach uses smart cards to store signature keys and master key parts. Signature keys and master key parts never appear in the clear outside the smart card.



 Understanding the Management Utilities 

The Management Utilities are composed of two applications that use smart cards to configure service instances: The Smart Card Utility Program and the Trusted Key Entry (TKE) application. To use the Management Utilities, you need to [order IBM-supported smart cards and smart card readers](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilitiesorder-smart-card-and-reader) and follow the instructions in [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities).

The following diagram illustrates the relationship between various components when you use the Management Utilities to initialize a service instance.

Zoom

!