I don't see this problem now when the build has no tags already.. I see both
SubversionTagAction and CVSSCM.TagAction both check TAG permission and don't
show the link if there are no tags yet.
If the build does have a tag already, it does show the link (with different
text.. instead of "Tag this build" it could be "Subversion tag" for example)..
you can click this to see the existing tag(s).. the problem here is it also
shows the form to create a new tag even if you don't have permission. If you
submit the form it shows a permission error.
I'll make it hide the form if you can't use it..