Study first
Review the ideas behind the questions
These notes help you review a GTM custom template before it is reused across a container. Focus on what the template can access, how it is tested, and what page-level policies can still block.
Prefer bounded templates over loose scripts
Custom templates are built around sandboxed JavaScript and permission checks, which makes them more governable than broad custom script patterns.
- The template editor separates Info, Fields, Code, and Permissions.
- Template code runs in a sandboxed JavaScript environment rather than the normal browser global environment.
- Permissions should be narrowed to the exact URLs, data layer keys, cookies, or storage values the template needs.
Test behavior and review permissions
Template tests can catch logic errors before deployment, but they do not replace permission review.
- Unit tests can run template code with sample inputs and assertions.
- Tests can expose missing-input behavior before a template is published.
- Permission checks do not happen on mocked APIs in unit tests, so permission review still matters.
Use page policies for stronger controls
A page policy can reject a custom template permission request when a site-level rule should override the template.
- The policy API can target one permission type or all policy checks.
- A policy function can reject a request by returning false or throwing an exception.
- Preview/debug evidence should be reviewed when a policy blocks a template action.