I observed an interesting behaviour in ManageIQ.
In access control I created a group and limited access with tag based expressions. Now I create a service dialog with a tag control field. I select a tag category where tags are set on instances which are allowed through tag based expression and some that are denied. Now, if I open the service dialog all instances with tags are shown, not only those that are allowed via tag based expression.
My assumption was that Tag control in Service Dialog would only show instances that are allowed via tag based expressions but obviously that is not the case.
Can someone reproduce or tell if that is the intended bahviour?