With koji 1.18, there are granular permissions which would allow MBS to perform its functions without needing the admin permission (thus giving it more power than it likely needs or should have).

The tag permission would allow adding/editing tags. The target permission would allow adding/removing targets. A hub policy around package list additions would permit mbs to do add-pkg on its own tags.

However, mbs is currently hard-coded when creating new module tags to set the required permission to admin. This means that only admins can tag builds there.

see KojiModuleBuilder.buildroot_connect in module_build_service/builder/KojiModuleBuilder.py

I'd propose that the permission be a configuration option. Then a unique permission could be granted to the mbs account, and this could be used to limit tags so that only mbs could tag builds there.