Action: GCP > Network > Firewall > Set Target Tags

Set a GCP Network firewall rule's target tags to the list computed by the Target Tags > Approved control (the approved subset of the rule's current target tags), removing only the unapproved target tags. Only the target tags are changed — allowed, sourceRanges and every other field on the rule are left untouched. The rule is never deleted, and the action refuses to write an empty target-tag set (an empty set would apply the rule to every instance in the network).