Restrict ability to add specific tags to certain users

Hi, I'm trying to create a workflow that restricts adding of specific tags (that should be publicly accessible) to specific users, but I'm struggling.

I'm trying to create a workflow that does this:

• Triggers when tags are updated (ideally when a specific tag, like "cto-approved" is added)
• Checks whether the loggedInUser belong to a group (such as "CTO") and asserts that the tag can only be added if they belong to that group.

My non-functional workflow is below.