Description of problem:
Creating a CFME tag category named: "Providers Type" with four tags: "aws, gce, rhev and vmw" then assigning the tags to four different roles/groups/users and each tag to a  different service catalog item doesn't allow to hide service catalog items from users belonging to different groups/roles.

Version-Release number of selected component (if applicable):
5.6.0.7-beta2.6 

How reproducible:
Everytime one tries to restrict visibility to Service Catalog items via tags/RBAC.

Steps to Reproduce:
1. Creating a CFME tag category named: "Providers Type" with four tags: "aws, gce, rhev and vmw".

2. Assign the tags to four different roles/groups/users and each tag to a different service catalog item.

3. Login as the user having its Service Catalog item tagged with its provider type tag.

Actual results:
The logged in user has visibility to all Service Catalog Items, even those that are tagged with other Providers type tags. 

Expected results:
The logged in user should only see and be able to interact with the Service Catalog items that have his tag (providers type tag)


Additional info: