The behavior is as follows:

* When writing a new secret, all required tags must be provided.
* When writing tags to a secret, and other tags are being deleted, then
  all required tags that are already present on the secret must be
  provided.
* When deleting tags from a secret, required tags may not be provided.

The second item is a bit subtle. If other tags aren't being deleted,
i.e., tags not provided are being left alone, then required tags don't
have to be provided (they may be, but don't have to be). Also, if other
tags *are* being deleted, then the only required tags that have to be
provided are those that are already set. These behaviors are designed so
that after a store's configuration is updated to require tags, you don't
have to then immediately set them all on every existing secret. Once you
do set them though, you can't get rid of them.