rely on default for tag_types roles, as this defaults to admin-only