See #35841 (comment) for context.

Currently, it's possible for two features to register the same tag for securing access to API endpoints. This can lead to collisions which could cause a user to have access to API endpoints they shouldn't have access to.

Example:

//Feature 1
xpackMain.registerFeature({
   id: 'feature1',
   privileges: {
      all: { api: ['foo'] }
   }
   ...,
});

// Feature 2
xpackMain.registerFeature({
   id: 'feature2',
   privileges: {
      all: { api: ['foo'] }
   }
   ...,
});

With this configuration, a user with access to only Feature 1 would have the ability to execute Feature 2's API endpoints (and vice versa).

With the NP initiative, we should explore alternate approaches to securing endpoints in a way that does not lead to collisions.