If a user is not able to create tags, can they see another user's tags?
CA Workload Automation iDash r12.0.03+ CA Embedded Entitlements Manager r12.51+
The idash-tag policy allows users to see all tags and create all tags. If a user is not supposed to be able to see a tag (or create a tag), you need to create an Explicit Deny idash-tag policy. In the Resources, you will specify the name(s) of the tags they shouldn't be able to see or create. See the attached idash-tag-deny-policy.jpg as an example.