Tags are managed entirely server side, so there's no priv esc issues. This lets my devices do what they want, and server style devices can't do anything.
Jake Howard