Description of problem: Creating a CFME tag category named: "Providers Type" with four tags: "aws, gce, rhev and vmw" then assigning the tags to four different roles/groups/users and each tag to a different service catalog item doesn't allow to hide service catalog items from users belonging to different groups/roles. Version-Release number of selected component (if applicable): 5.6.0.7-beta2.6 How reproducible: Everytime one tries to restrict visibility to Service Catalog items via tags/RBAC. Steps to Reproduce: 1. Creating a CFME tag category named: "Providers Type" with four tags: "aws, gce, rhev and vmw". 2. Assign the tags to four different roles/groups/users and each tag to a different service catalog item. 3. Login as the user having its Service Catalog item tagged with its provider type tag. Actual results: The logged in user has visibility to all Service Catalog Items, even those that are tagged with other Providers type tags. Expected results: The logged in user should only see and be able to interact with the Service Catalog items that have his tag (providers type tag) Additional info: