group ACL control using tags (group must be "visible")