In the organisation I am with we have implemented civicrm multisite and we only let very few users have permissions of "edit all contacts" or "view all contacts" etc. For our states they get "view all contacts in domain" or "Edit all contacts in domain" this then causes an issue if they want to tag a record in CiviCRM.
If they click on the tags tab on a record and attempt to tag a record via that function there they get "API permission check failed for entity_tag/create call; insufficient permission: require access CiviCRM and edit all contacts." However they are able to remove the tag via this method but not add a tag.
A work around is that they click on the edit button at the top and do the full contact record edit and then are able to add tags.