This would potentially be a GCI task. It's not clear where this should be implemented in the code stack, though. At the level of ChangeTags::can*Tag? At the API/special page level? Or somewhere in between?

It's very difficult to tell how other parts of MediaWiki (e.g. patrolling) do this.

In T102063#1810405, @TTO wrote:

It's not clear where this should be implemented in the code stack, though. At the level of ChangeTags::can*Tag?

Since that's where other permissions checks are, I'd say that would be a good place for them.

At the API/special page level?

It wouldn't hurt to check up front here too, to avoid doing work that is just going to be rejected later.

Change 259442 had a related patch set uploaded (by Unicornisaurous):
Prevent blocked users from changing tags

https://gerrit.wikimedia.org/r/259442

Change 259442 merged by jenkins-bot:
Prevent blocked users from modifying change tags

https://gerrit.wikimedia.org/r/259442