diff --git a/cmd/frostfs-node/config/engine/config_test.go b/cmd/frostfs-node/config/engine/config_test.go
index eaf2a294e..22f26268d 100644
--- a/cmd/frostfs-node/config/engine/config_test.go
+++ b/cmd/frostfs-node/config/engine/config_test.go
@@ -168,9 +168,10 @@ func TestEngineSection(t *testing.T) {
 							LimitOps: toPtr(25000),
 						},
 						{
-							Tag:      "policer",
-							Weight:   toPtr(5),
-							LimitOps: toPtr(25000),
+							Tag:        "policer",
+							Weight:     toPtr(5),
+							LimitOps:   toPtr(25000),
+							Prohibited: true,
 						},
 					})
 				require.ElementsMatch(t, writeLimits.Tags,
diff --git a/cmd/frostfs-node/config/engine/shard/limits/config.go b/cmd/frostfs-node/config/engine/shard/limits/config.go
index b9b5c4382..8444d6aa8 100644
--- a/cmd/frostfs-node/config/engine/shard/limits/config.go
+++ b/cmd/frostfs-node/config/engine/shard/limits/config.go
@@ -84,6 +84,7 @@ type IOTagConfig struct {
 	Weight      *float64
 	LimitOps    *float64
 	ReservedOps *float64
+	Prohibited  bool
 }
 
 func tags(c *config.Config) []IOTagConfig {
@@ -119,6 +120,13 @@ func tags(c *config.Config) []IOTagConfig {
 			tagConfig.ReservedOps = &r
 		}
 
+		v = c.Value(strconv.Itoa(i) + ".prohibited")
+		if v != nil {
+			r, err := cast.ToBoolE(v)
+			panicOnErr(err)
+			tagConfig.Prohibited = r
+		}
+
 		result = append(result, tagConfig)
 	}
 }
diff --git a/config/example/node.env b/config/example/node.env
index 010b6840c..b7c798ad8 100644
--- a/config/example/node.env
+++ b/config/example/node.env
@@ -180,6 +180,7 @@ FROSTFS_STORAGE_SHARD_0_LIMITS_READ_TAGS_3_LIMIT_OPS=25000
 FROSTFS_STORAGE_SHARD_0_LIMITS_READ_TAGS_4_TAG=policer
 FROSTFS_STORAGE_SHARD_0_LIMITS_READ_TAGS_4_WEIGHT=5
 FROSTFS_STORAGE_SHARD_0_LIMITS_READ_TAGS_4_LIMIT_OPS=25000
+FROSTFS_STORAGE_SHARD_0_LIMITS_READ_TAGS_4_PROHIBITED=true
 FROSTFS_STORAGE_SHARD_0_LIMITS_WRITE_TAGS_0_TAG=internal
 FROSTFS_STORAGE_SHARD_0_LIMITS_WRITE_TAGS_0_WEIGHT=200
 FROSTFS_STORAGE_SHARD_0_LIMITS_WRITE_TAGS_0_LIMIT_OPS=0
diff --git a/config/example/node.json b/config/example/node.json
index b26c35d2c..2f4413e4d 100644
--- a/config/example/node.json
+++ b/config/example/node.json
@@ -252,7 +252,8 @@
               {
                 "tag": "policer",
                 "weight": 5,
-                "limit_ops": 25000
+                "limit_ops": 25000,
+                "prohibited": true
               }
             ]
           },
diff --git a/config/example/node.yaml b/config/example/node.yaml
index 58b687d5c..a07795da5 100644
--- a/config/example/node.yaml
+++ b/config/example/node.yaml
@@ -249,6 +249,7 @@ storage:
           - tag: policer
             weight: 5
             limit_ops: 25000
+            prohibited: true
         write:
           max_running_ops: 1000
           max_waiting_ops: 100
diff --git a/docs/storage-node-configuration.md b/docs/storage-node-configuration.md
index 51f0a9669..3944f663f 100644
--- a/docs/storage-node-configuration.md
+++ b/docs/storage-node-configuration.md
@@ -359,6 +359,7 @@ limits:
 | `tag.weight`            | `float`  | 0 (no weight)  | Weight for queries with the specified tag. Weights must be specified for all tags or not specified for any one. |
 | `tag.limit_ops`         | `float`  | 0 (no limit)   | Operations per second rate limit for queries with the specified tag.                                            |
 | `tag.reserved_ops`      | `float`  | 0 (no reserve) | Reserved operations per second rate for queries with the specified tag.                                         |
+| `tag.prohibited`        | `bool`   | false          | If true, operations with this specified tag will be prohibited.                                                 |
 
 # `node` section
 
diff --git a/internal/qos/limiter.go b/internal/qos/limiter.go
index 98d254fd0..c73481c2c 100644
--- a/internal/qos/limiter.go
+++ b/internal/qos/limiter.go
@@ -90,6 +90,7 @@ func converToSchedulingTags(limits []limits.IOTagConfig) map[string]scheduling.T
 		if l.ReservedOps != nil && *l.ReservedOps != 0 {
 			v.ReservedIOPS = l.ReservedOps
 		}
+		v.Prohibited = l.Prohibited
 		result[l.Tag] = v
 	}
 	return result
@@ -164,8 +165,7 @@ func requestArrival(ctx context.Context, s scheduler, stats map[string]*stat) (R
 	rel, err := s.RequestArrival(ctx, tag)
 	stat.inProgress.Add(1)
 	if err != nil {
-		if errors.Is(err, scheduling.ErrMClockSchedulerRequestLimitExceeded) ||
-			errors.Is(err, errSemaphoreLimitExceeded) {
+		if isResourceExhaustedErr(err) {
 			stat.resourceExhausted.Add(1)
 			return nil, &apistatus.ResourceExhausted{}
 		}
@@ -234,3 +234,9 @@ func exportMetrics(metrics Metrics, stats map[string]*stat, shardID, operation s
 		metrics.SetOperationTagCounters(shardID, operation, tag, pending, inProgress, completed, resExh)
 	}
 }
+
+func isResourceExhaustedErr(err error) bool {
+	return errors.Is(err, scheduling.ErrMClockSchedulerRequestLimitExceeded) ||
+		errors.Is(err, errSemaphoreLimitExceeded) ||
+		errors.Is(err, scheduling.ErrTagRequestsProhibited)
+}