My team want to tag release commits. Once a release tag is created, the tag should not be able to be moved or deleted (except by authorized users/admins).

We have tried to limit tag changes with branch permissions (using a branch pattern of /refs/tags/* and selecting "Prevent Deletion" and "Prevent Rewriting History") but that only stopped tag deletion. I was able to change the commit the tag pointed to.