limited tagging support

I'd like to be able to limit access so that a release manager could submit tags, but can't submit code changes. (Because our release manager also is a developer.) At some level I realize that this could be done with human process enforcement, but I'm wondering if the tool can provide an extra level of caution.

In fact, what I'd really like to do is be able to create a deployment key that allows pulling, and tagging, but nothing else. Is it possible?

Alternatively, a way to push a tag from the UI would be great.