How to restrict tagging

Also, as of mid-January, TL4 is the min trust to create tag default value, and TL3 is the default for tag usage.