The solaris.label.zone.manage authorization grants the ability to assign labels to zones.