Organize people and services

A policy that repeats individual email addresses and IPs in every rule becomes impossible to review. The fix is a layer of names.

Three devices and one admin? Raw identities are fine. Ten people and thirty servers? Every hire and every new machine means editing every rule that mentions them. You will miss one.

Groups for people

Groups collect users. Define them once, reference them everywhere:

{
  "groups": {
    "group:operators": ["[email protected]", "[email protected]"]
  }
}

Now a grant can say "src": ["group:operators"]. When someone joins the team, you edit one line, and every rule that references the group follows. When someone leaves, same thing.

Tags for services

Tags describe non-human devices by role, such as tag:server or tag:database. A tagged device is not owned by whoever enrolled it. Its identity is the tag.

This matters for servers. The machine should keep working, and keep its policy identity, after the person who set it up leaves the company. A server owned by a departed employee is a problem waiting to happen.

Assigning a powerful tag changes authorization, so tagOwners controls who may assign each one:

{
  "tagOwners": {
    "tag:server": ["group:operators"],
    "tag:database": ["group:operators"]
  }
}

Think about what happens without this. If anyone could apply tag:database to their own laptop, they would inherit every grant that targets databases. Tag assignment is a privileged operation. Treat the owner list like you treat the admin list.

Autogroups for built-in roles

Autogroups select built-in sets of identities. autogroup:member means every user in the tailnet. autogroup:admin means the admins. autogroup:self means a device’s own user.

They cover policies like “everyone may reach the internal wiki” without maintaining a group by hand. Use them when the built-in set is exactly what you mean, and a named group when it is not.

Set up the lab

Create a group:operators group with your identity in it, and let only that group own tag:server. Keep human laptops user-owned. Do not tag everything just because you can.

A laptop’s identity should be its person. That is what makes user-based rules like “Flavio may SSH to servers” meaningful when you read them a year from now.