Hi,

You can achieve this by following the steps below:

1. Go to Settings and enable developer mode.
2. Create a new user group with the application as Other Extra Rights and provide a name for it, such as "Restrict VIP Contacts." Add the users you want to restrict to this group.
3. Create a record rule with the following configuration:

• Here, Set the domain filter to: ["|", ("category_id", "not in", [1]), ("category_id", "=", [])]. Here, [1] represents the external ID of the "VIP" tag in my instance. Replace it with your specific external ID.
• Add the user group you created ("Restrict VIP Contacts") under the Group section of the record rule page.
• Select all the access rights in the record rule.

By doing this, you can restrict certain users from accessing contacts with the "VIP" tag.

Hope this helps.

Thanks.