How does 802.1x implementation in MikroTik work for tagged ports? And how does it work for routers? It's especially complicated for routers - if I have VLAN interfaces attached to physical interface am I supposed to run 802.1x on physical interface or on VLAN interface?

Wiki mentions untagged VLAN assignment but this setup requires configuring tagged VLANs on those ports. Does it mean that client which successfully authorizes and gets some untagged VLAN assigned will be also able to access all previously configured tagged VLANs if he enables VLAN tagging on his machine?