Source

Documentation (access control) — Tailscale

Checked for Tailscale on 5 Nov 2026

Technical details

type: page
http status: 200
content hash: sha256:8cf2e6e9ffc8af73d0126b523f8a804166536d6e27c709465798ccb5e4f5998d
permission: robots_ok
screenshot: Screenshot on file (internal exhibit, not published)

Cited by

Default deny Report an error

“By default, all connections between devices in your Tailscale network (known as a tailnet) are denied unless explicitly permitted through your tailnet policy file.”
Access control methods Report an error

“There are two primary methods for creating access control policies: Grants and access control lists (ACLs).”
Grants recommended Report an error

“Grants are the recommended method and offer more functionality. However, ACLs will always be supported.”
Policy selectors Report an error

“These include autogroups, custom groups, tags, IP addresses, and individual users”
Grants unified syntax Report an error

“Grants represent Tailscale's modern approach to access control, providing a unified syntax for managing permissions across both network and application layers.”
Tailscale ssh identity auth Report an error

“Instead of managing SSH keys, Tailscale SSH leverages your tailnet's identity system to authenticate and authorize connections based on the rules defined in your tailnet policy file.”
Acl migration recommendation Report an error

“Tailscale recommends migrating to grants.”