diff --git a/app/models/classification.rb b/app/models/classification.rb
index 70fee5a0505..1f30614c94f 100644
--- a/app/models/classification.rb
+++ b/app/models/classification.rb
@@ -31,6 +31,9 @@ class Classification < ApplicationRecord
   scope :read_only,  -> { where :read_only => true }
   scope :writeable,  -> { where :read_only => false }
 
+  scope :is_category, -> { where(:parent_id => 0) }
+  scope :is_entry,    -> { where.not(:parent_id => 0) }
+
   DEFAULT_NAMESPACE = "/managed"
 
   default_value_for :read_only,    false
diff --git a/app/models/container_label_tag_mapping.rb b/app/models/container_label_tag_mapping.rb
index 090bac7cccb..a054fce3ca1 100644
--- a/app/models/container_label_tag_mapping.rb
+++ b/app/models/container_label_tag_mapping.rb
@@ -12,6 +12,7 @@ class ContainerLabelTagMapping < ApplicationRecord
   #
   # All involved tags must also have a Classification.
 
+  TAG_PREFIXES = ['/managed/amazon:', '/managed/kubernetes:'].freeze
   AUTOTAG_PREFIX = "kubernetes".freeze
 
   MAPPABLE_ENTITIES = [
diff --git a/app/models/tag.rb b/app/models/tag.rb
index 68073e5fca3..e5d55a04eb7 100644
--- a/app/models/tag.rb
+++ b/app/models/tag.rb
@@ -8,6 +8,13 @@ class Tag < ApplicationRecord
 
   before_destroy :remove_from_managed_filters
 
+  # Note those scopes exclude Tags that don't have a Classification.
+  scope :visible,   -> { joins(:classification).merge(Classification.visible) }
+  scope :read_only, -> { joins(:classification).merge(Classification.read_only) }
+  scope :writable,  -> { joins(:classification).merge(Classification.writable) }
+  scope :is_category, -> { joins(:classification).merge(Classification.is_category) }
+  scope :is_entry,    -> { joins(:classification).merge(Classification.is_entry) }
+
   def self.list(object, options = {})
     ns = get_namespace(options)
     if ns[0..7] == "/virtual"