Is there a way to determine when a tag was added/removed from a node?
Backup your Chef configurations from your server, including nodes, roles, environments, etc., and put them in source control on a regular basis. It's one of the most effective ways to track changes, and sets of changes, especially when you have multiple people uploading content to the chef server, and someone thinks it's a good idea to hand-edit content on the server directly without sourcing the changes from a git repo. I'm particularly minded of a colleague who used to add elements to run lists without telling anyone, or edit node attributes manually without ever putting them in a role.
Thank you, @nkadel, that's a good idea.
Chef doesn't appear to log tag creation/deletion events to any of the Chef Server logs, as far as I can tell. So I can't see any way to determine when a tag was added short of a roll-your-own solution like the one you describe. And even that solution, if I understand it right, would only give you the time-granularity of the frequency with which you back up your node data.