acl: fix cli tag parsing