This could either be a limitation built on the user/group profile or you could restrict users based on the tag on the script.
Use case:
I've built an NCM view for our NOC. I would like for them to be able to run some of our scripts such as "enable netflow" but not other scripts that if misconfigured would be a headache to resolve.