@joergi I think having two levels of settings, site-wide and per-tag, makes sense.

site-wide default: "allow" or "deny". If a tag doesn't have a value, use this.
per-tag override: "allow" or "deny". This overrides the site-wide default. If it's the same as the site-wide default, it doesn't matter.

So, maybe you'd do something like this:

PM tags.pub "set permission deny" (this sets the permissions off by default)
PM linux at tags.pub "set permission allow" (overrides default)