Mike Bazeley pointed to to this tagging engine that can be implemented in a behind-the-firewall scenario. I posted a query about this a while back, and have some emails to respond to still (sorry), but it looks like I’m not alone in wanting this functionality.