Tailscale Connectivity and Tailscale SSH Are Different Permissions
A peer can be reachable over the tailnet while an SSH login is correctly denied by another policy layer.
A peer can be reachable over the tailnet while an SSH login is correctly denied by another policy layer.
I can send SSH packets over the tailnet without asking Tailscale to become the SSH authentication system.
Once the tailnet becomes a real operational network, who can reach which host and service should not live only in memory.