I’ve been looking around, but all of the answers seem to be for a different case. Here goes:
We want to have a publicly visible tag that can only be assigned by a handful of members. Everyoene can see the tag on the post, and access the tag URL to view other posts with the tag, but only a couple of staffers will be able to assign it to a post.
Is that workable using exiting restriction options?