My team want to tag release commits. Once a release tag is created, the tag should not be able to be moved or deleted (except by authorized users/admins).

Workaround

If you only want to prevent tag deletion, you can do this with branch permissions. In repository settings, create a branch permission with a branch pattern of /refs/tags/* and select "Prevent Deletion".