Role-based freeform tagging

Title: Allow freeform tag creation by role when Tag Administration is enabled

Current behavior. Tag Administration is a single tenant-wide switch. Off, and any user can create tags freely. On, and nobody can, so every tag has to be pre-created by an administrator in Tag Manager before anyone can apply it to content. There is no middle setting.

The problem. These two states serve opposite needs and most enterprise customers need both at once. Structural tags that drive routing must stay locked, because an accidental variant silently breaks content delivery. But ad hoc tags used for organizing and retrieving content, campaign names being the common case, need to be created by the people doing the work. Forcing those through an administrator makes the queue the bottleneck, and the usual outcome is that customers turn Tag Administration off entirely and accept tag drift.

Requested change. Make freeform tag creation a role-level permission rather than a tenant-level switch. Proposed model when Tag Administration is enabled: