Tailscale source-first coverage reconciliation

Checked 2026-11-05 UTC, against main ab1d56a13983f98774c25ca3ac8d8bea754bd14f. Skills PR #134 was already merged at that base. This pass follows its update, pack, source-discovery and verification instructions. It does not merge or alter that PR.

No tenants declared — Tier 0+1 only; VERIFIED-LIVE = 0. Documentation evidence and offline tests do not establish runtime enforcement. The guide stays exactly ["ai-drafted"]. See refresh verification for actual execution results and initial evidence for the historical 18-control pass.

Discovery boundary and method

The working inventory was opened before selecting new controls, using the official feature index, client index, separate daemon reference and system-policy reference. The feature index exposes state storage, client governance, sharing, routing, integrations and separate products; it is not just an index of tailnet-policy fields. Feature/configuration bodies, limitations, version/default history and recovery were then read. Existing headings and last_updated did not bound discovery.

All linked configuration sources below were read through the web retrieval tool on 2026-11-05; source-code/schema files were read through the authorized GitHub connector. Each row records a content-specific observation. An index is a discovery lead, not proof that every linked feature works. Earlier direct shell HTTP attempts did not complete; successful web/GitHub retrieval is a distinct fallback, not a relabeling of those failures. No signed-in Tailscale console was accessed. Search results that only mention Tailscale were not admitted as configuration authority.

Scope is core tailnet administration and its installed client/daemon, system-policy/MDM, posture, identity and workload-integration boundaries. Product protection of its own identity state is in scope even when the implementation uses TPM/Keychain. Generic disk/cloud/cluster hardening, secret rotation, separate PAM/Aperture administration and application deployment runbooks remain outside this guide.

Candidate ledger

Covered means the cited guide text addresses the requirement and its limits; it does not mean verified live. Exclusions name a scope reason. Unverified retains an actual evidence boundary rather than asserting absent capability. Closely related candidates share controls. The ledger was reconciled against the final guidance, not produced by parsing the guide into a source list.

ID Candidate and source section Plane; conditions and observation Disposition and actual guidance
C01 Security best practices, authentication; Entra provisioning, assignment IdP/console. Authentication is delegated; application assignment and already-enrolled nodes need separate treatment. Covered — 1.1. Upstream phishing-resistant MFA, assignment, pilot and existing-node review; no invented Tailscale MFA toggle.
C02 User roles; user approval; provisioning Identity/console. Advanced roles have plan limits. Specific approval docs prohibit combining user approval with SCIM; generic provisioning overview conflicts. Suspension/deactivation semantics differ by IdP. Covered — 1.2. Role/membership inventory, explicit conflict, IdP offboarding and recovery tests. No assumption that IdP suspension revokes every node.
C03 Device approval, preapproved keys and limitations Enrollment/console. Preapproval bypasses manual approval; physical-device boundary; mutually exclusive with Lock. Covered — 1.3. Enrollment choice, exception inventory and real-device negative tests; default read is not retroactive integrity proof.
C04 Key expiry; tags, authentication Client/identity. Tagged authentication disables expiry initially and on reauthentication. Node/auth/API keys have different lifetimes. Covered — 1.4, 2.3, 3.2. Exception review, tagged lifecycle and independent recovery before reauthentication.
C05 Tailnet Lock, enablement, disablement and limitations Client/console. Personal/Enterprise; 1.46.1+; console prepares CLI initialization. Signer and disablement-secret custody determine recovery. Covered — 1.5. At least two signers, approved initialization, independent comparison, recovery custody; pack only reads status.
C06 Secure node state storage, enablement, defaults and recovery; MDM keys Daemon/native policy/posture. Linux/Windows TPM 2.0; standalone macOS Keychain; 1.86+ support; Linux policy loader 1.102+. Windows/Linux opt-in since 1.92.5 after an earlier default-on interval. Covered — new 1.6. Platform table, no-GUI verdict, settings generators, restart/hardware/recovery caveats and selected attribute collector. Generic posture text alone did not cover this omission.
C07 Grants versus ACLs; grants syntax; ACL defaults Central policy. Grants preferred for new policies; permits combine with legacy ACLs. Existing broad permits survive a restrictive addition. Covered — 2.1. Complete-policy review/generator, remove broad permits, explicit application capabilities and identity-to-service paths.
C08 Policy-file reference, tests/sshTests; trust scopes Policy/API. Network and SSH tests differ; validation POST does not apply. Omitted/empty policy sections have meaningful defaults. Covered — 2.2. Positive/negative tests, full candidate, dependent read scopes and no automatic apply; local tests do not execute the vendor policy engine.
C09 Tags, ownership and identity Policy/enrollment. Tags replace user identity and permissions combine; privileged role/tag-owner authority matters. Covered — 2.3. Explicit owners, combined permissions and workload identity; privileged credential/tag review.
C10 Tailscale SSH, check mode and users Policy/daemon. Requires both network access and SSH authorization; destination opt-in and mapped OS account matter. Covered — 2.4. Reauthentication/check mode, named accounts, destination support and negative tests. SSH agent/port forwarding requires explicit review.
C11 Postures and attributes, built-ins, combinations and sharing limits Posture/client/integration. Missing required attributes do not match. External shared-node clients and subnet devices are outside the stated posture boundary. node:tsStateEncrypted leads to a separate setup feature. Covered — 2.5 and 1.6. Signal freshness/type, missing-value tests, AND/OR behavior and sharing limit. Docs list Boolean values but show a quoted-string state expression; no untested enforcement expression is shipped.
C12 Trust credentials; OAuth lifecycle; provider federation API/workload identity. Scope/tag/claim constraints and creator removal differ from user sessions. Known-ID metadata is not a complete all-principal inventory. Covered — 3.1. Narrow approved authority, claim restrictions and console reconciliation; no credential creation.
C13 Auth keys, reusable, ephemeral and tagged enrollment CI/enrollment. Key metadata, enrolled identity and reachable service authority are distinct; reusable preapproved keys increase blast radius. Covered — 3.2. Narrow ephemeral workload access, trusted workflow context, auth-key metadata and no enrollment/credential creation by packs.
C14 Subnet routers; exit nodes; app connectors Client/routing/policy. Advertisement, approval and access grants differ. App domains and connector tag authority can expose routed services. Covered — 3.3. Complete approved routes, app-domain/connector review, route/default/SNAT caveats and downstream authentication. Terraform deliberately rejects default routes.
C15 Services, hosts and endpoint validation Service/policy/client. Hosts require tags and 1.86+; host approval and autoApprovers differ from local Serve configuration; older Linux clients differ on accept-routes. Covered — 3.3. Central host approval, endpoint validation, svc grants and local Serve status. A local config snapshot does not prove approval.
C16 Sharing; declarative sharing Cross-tailnet policy/console. Link sharing and alpha declarative sharing coexist; declarative flow requires both parties’ policy and has unsupported resource types. Covered — 4.1. Recipient/quarantine/revocation review and double opt-in externalTailnets boundaries; existing API covers inbound external devices only.
C17 External user invitations, joining roles Console/identity. Joining a tailnet is distinct from receiving access to one shared node. Covered — 4.1. External-joining role, invites and approved membership reconciliation.
C18 Funnel, policy and public exposure; Serve status Client/central policy. Funnel publishes publicly; Serve is a different boundary. An attribute, local publisher and downstream application auth all matter. Covered — 4.2 and 3.3. Restrict publication authority, review local Funnel/Serve configuration, do not launch an enablement wizard.
C19 Client updates; security bulletins Console/native client/MDM. Update support depends on package; changing new-device defaults does not update existing fleet preferences. Covered — 4.3, 4.5. Current supported patch baseline, old-client inventory and platform-specific update owner. Feature floors are not patch targets.
C20 Client preferences, incoming connections Client/system policy. Incoming is allowed subject to policy by default. Shields-up blocks Tailscale inbound including ping; not a LAN firewall. Covered — new 4.4. Role exceptions, actual inbound tests, selected read-only preferences and managed-policy handle.
C21 System policies; Linux, Windows, macOS deployment Native policy/MDM. Required Tailnet ID differs from suggested ID; AlwaysOn keys/platforms, override reason and reconnect timer differ. Linux 1.102+ loader is newer. Covered — new 4.5. Explicit ID/platform/version candidate, no AuthKey/LoginURL, selected effective-policy evidence, no fabricated console toggle or universal MDM path.
C22 Taildrop, permissions and settings Console/client. Alpha; own-user device transfers do not obey network ACL restrictions; tagged devices are not eligible. Covered — new 4.6. Disable unnecessary Send Files, explicit approved use and separate Taildrive model; no transfer is executed.
C23 Taildrive, enablement and grants Client/application capability. Alpha, 1.64+; share-host and accessor attributes plus per-share ro/rw grants; local shares are separate. Covered — new 4.6. Approved-use-only read-only share fragment, removal of unnecessary capabilities, actual share-list collector; no share creation.
C24 SSH session recording, deprecation and failure policy Legacy recording/storage. Specific docs mark it deprecated, closed to new users, existing-user support scheduled through August 2027. Broader best-practices page still recommends recording. Covered — 2.4 legacy transition. Prefer the specific lifecycle notice, plan supported replacement, review fail-open/fail-closed and sensitive storage for existing deployments. No new legacy-recorder pack.
C25 Configuration audit, retention and limits Console/API/SIEM. Enabled by default, 90-day retention, read/support coverage limitations and grouped events. Covered — 5.1. Bounded export, overlap/retention/privacy and actual ingestion review; eventGroupID not treated as a unique event.
C26 Network flow logs; streaming Logging/client/destination. Premium/Enterprise, 30-day network history, supported clients/no-logs exceptions; stream configuration is not delivery. Covered — 5.2. Collection default, destination trust, retention/freshness and live delivery test instructions; no cloud destination created.
C27 Webhooks, signature verification and lifecycle Event integration. HMAC/timestamp replay check, shared-secret trust, persistent integration after creator removal. Covered — 5.1. Destination ownership, signature/replay and subscriptions; webhook is not retained audit history. No receiver/secret is created.
C28 DNS; HTTPS certificates; rebinding Central DNS/client/public certificate issuance. Client adoption, split DNS, Override DNS and exit-node paths differ; Certificate Transparency publishes names. Covered — new 4.7. Complete DNS owner, scoped reads, real resolver tests, disclosure decision and no test issuance. Exit-node resolver flags require 1.88.1+.
C29 Device web interface; daemon listeners Client/daemon/local API. Remote preference differs from local UI; reachable 5252 exposes metadata. Tagged webui capability boundary requires 1.62+. Separate proxies can bind beyond loopback. Covered — 4.4. Narrow network/app authority, disable-web-client fragment, listener/operator review; no claim a false remote preference disables every UI.
C30 Fast switching; Android split tunneling; VPN On Demand Client/native policy. Switching retains cached accounts, one active tailnet; Android 1.70+ app exceptions affect traffic and DNS. Apple AlwaysOn cannot coexist with a managed VPN profile; custom rules can prevent reconnection. Covered — 4.5. Review cached identities, registration, app/network exceptions and actual behavior. Mobile-specific deployment artifacts are not generated.
C31 Firewall mode, security implications Daemon implementation. Choosing iptables/nftables does not change Tailscale’s packet-filter security; debug selection is not a universal supported hardening value. Excluded as a separate control. Transport/backend implementation choice alone is not a security requirement. Native route/filtering risks remain in 3.3; generic host-firewall configuration is outside scope.
C32 Daemon state, state backends Daemon/deployment. Local file, memory and remote SSM backends have distinct behavior; SSM’s explicit KMS selection is not configured by a local TPM flag. Covered — 1.6 operational boundary. Inventory backend; do not claim local-file encryption covers remote/in-memory state. Generic AWS IAM/KMS hardening remains external.
C33 Peer relay; routing; policy capabilities Client/policy. Peer relay requires 1.86+, listener and relay capability; application grants remain separate. SNAT/stateful defaults have changed historically. Covered — 2.1, 3.3. Relay application-capability review, route/auto-approver boundaries, version-specific SNAT/filter review. Availability/transport tuning alone is not a separate hardening control.
C34 tsnet; tsidp Application integration. Embedded network stack and experimental identity server have application-specific listener/OIDC responsibilities. Excluded deployment runbooks. Core credential, identity, state and grant boundaries remain 1.6, 2.1–2.3, 3.1–3.2. This guide does not validate custom application authentication or tsidp.
C35 Domain ownership, lifetime and aliases Identity/organization. Organization must retain domain control; retirement does not delete the tailnet. Distinct tailnets have distinct trust boundaries. Covered — 1.2, 4.1. Domain lifecycle, approved membership and explicit external-reference review.
C36 Accessbot/JIT, posture attributes Posture/integration. Premium/Enterprise custom attributes; expiry and approving integration authority need review. Covered — 2.5. Scoped/expiring JIT attributes, actual expiry access tests and no assumption a timestamp proves enforcement.
C37 Client metrics; daemon diagnostics Client/local endpoint. Metrics from 1.78+; advertised-route counters can include unapproved routes; diagnostics can reveal metadata. Covered — 5.2, 4.4. Distinguish metrics from audit/flow/session content, restrict exposed endpoints and protect exports. No undocumented metrics capability is invented.
C38 Kubernetes operator; API access Operator/integration proxy. Default authentication impersonates user identity; tagged nodes/group overrides and noauth affect the Kubernetes boundary. Covered — 3.3 boundary review. Explicit proxy authentication and impersonation review. Full cluster RBAC, operator deployment and container hardening belong to a separate deployment owner; not validated here.
C39 Feature index, PAM and Aperture Separate product planes with their own policy/administration. Excluded — declared core-tailnet scope. No claim this is a PAM/Aperture guide or that the core-tailnet packs manage them.
C40 Scope policy; secure state External host/cloud/cluster versus native identity state. Generic encryption and rotation are not vendor security settings; native Tailscale state protection is. Excluded generic infrastructure/rotation. Native identity-state omission explicitly resolved in 1.6; scope is not determined by the word encryption.
C41 Security bulletins, 2026-10-26 SSH/Serve advisories Client/daemon/application. Four advisories fixed in 1.104.4+, including Unix-socket forwarding and Serve backend/capability issues. SSH forwarding mitigation is documented pending patch. Covered — 2.4, 4.3. Current patch advice, service-environment forwarding mitigation and application/Serve boundary review; no local service restart or flag change performed.
C42 System policies, MachineCertificateSubject Windows/customer integration. Public key table identifies a customer-specific certificate setting but directs customers to separate documentation; that documentation is not supplied. Unverified. Not labeled absent or implemented from a guessed value. Requires vendor/customer configuration contract and a suitable managed pilot; no complete feature-coverage claim.

Reconciliation: 42 candidates: 37 covered, 4 excluded, 1 unverified, 0 unresolved documented guidance gaps inside the declared scope. There are 23 authored controls and 39 source packs; those counts are different measures. The unverified customer-specific integration, runtime posture-expression type and untested fleet/platform behavior limit the result.

Interface census and implementation decisions

The six-surface census was repeated independently of the client-feature inventory. Handles, lifecycle and implementation decisions are separate. Available mutating interfaces are documented even when a safe collector is shipped instead. The historical matrix retains the original 18-control interface inventory; the rows below supplement it for the new controls and newly discovered areas.

Surface Current evidence and observation Decision / bounded negative conclusion
Terraform v0.29.3 resource directory and data sources read through GitHub. Resources include complete/individual DNS, ACL, device authorization/key/routes/tags, contacts, identities, settings, streams, webhook and Services. Data sources include ACL, device(s), service, user(s), 4via6. Pinned version unchanged. Complete DNS owner added; no mix with individual DNS owners. No native EncryptState/MDM resource or posture-attribute data source in this fetched version’s complete index. This is not a claim about every future version or API.
REST / GraphQL API reference, trust scopes and maintained client source. Device attribute GET and four legacy DNS GETs are available; policy read/write/preview/validation and other prior handles remain available. Two scoped REST collectors added. Public census read did not document GraphQL or an endpoint deploying native EncryptState/MDM settings; an unavailable page would not prove absence. No credential creation or policy apply is implemented.
First-party CLI Client CLI and separate tailscaled reference. Fixed reads: Serve/Funnel status, get, syspolicy list, drive list, dns status; daemon flags and syspolicy reload are distinct. Five local read packs added. Daemon mutation belongs to approved service management, not a collector. get reads only the active tailnet; policy reload and mutating commands are rejected by the helper. Version-unavailable commands fail unknown, not compliant.
Official SDK Go SDK v2.12.0 devices.go, dns.go GetPostureAttributes and legacy DNS methods are available, not absent. REST supplies the newly added equivalent reads; adding duplicate SDK wrappers was not needed to change the safety boundary. Existing pinned device SDK pack remains. Typed ACL limitations still favor raw policy preservation.
Native configuration Policy-file syntax, system keys, three MDM references and Windows ADMX Both central HuJSON and device/system settings were reviewed. Two platform-aware generators and two central-policy fragments added. Linux flat JSON, Windows machine-policy DWORD/string and standalone-macOS plist formats differ; artifacts are fragments, not installers or complete MDM profiles.
SIEM / native query Audit events, flow logs, webhooks, metrics Existing SPL consumes documented JSON. These docs do not define a vendor-native database query surface. Webhooks/metrics are not retained audit or network-flow proof; no generic query skeleton or fabricated field added.
Control / area Read handles Write / configuration handles and lifecycle Pack decision and limits
1.6 stored identity GET /device/{id}/attributes; syspolicy list --json for selected configuration Linux --encrypt-state (1.86+); EncryptState device policy (Windows/standalone macOS 1.86+, Linux loader 1.102+) API projects only the state attribute; config emits three platform formats. No GUI enablement, hardware test, install, restart or recovery operation.
3.3 Services / connectors / relays serve status --json; device route GETs; provider service data Service resource/API, host approval, autoApprovers.services, connector domain definitions, relay app grants Local Serve read added. Central policy and guide review cover authority; no autoapproval, listener or publication started. Full application/deployment owner still required.
4.4 inbound / web UI get --json shields-up, get --json webclient tailscale set, AllowIncomingConnections system policy, disable-web-client node attribute, webui app grants Selected CLI read plus member-device policy fragment. Available setters are not secretly executed; false remote preference does not establish local UI disabled.
4.5 managed client syspolicy list --json; platform/MDM evidence Native Tailnet, PostureChecking, AlwaysOn and reconnect policies; Windows registry and Apple managed preferences, Linux JSON Config generator requires explicit platform/version and unique ID. CLI whitelists nonsecret keys. No MDM API/console path guessed; customer-specific certificate policy remains unverified.
4.6 file sharing drive list; central nodeAttrs/app grants; console Send Files Taildrop toggle; alpha Taildrive nodeAttrs, per-share grants and local share commands Share-list read and approved-use-only restrictive fragment. Taildrop has no native toggle handle in fetched tailnet_settings provider schema; do not infer no management surface anywhere. No share creation/file transfer.
4.7 DNS / certificates Four legacy GET /tailnet/{tailnet}/dns/{nameservers,preferences,searchpaths,split-dns}; dns status --json; SDK equivalents Complete tailscale_dns_configuration resource; individual DNS resources; central DNS settings; separate certificate issuance REST states incomplete coverage (not Override DNS/exit-node flags/certificates). Complete optional Terraform owner with import/recovery guidance; local status is not a resolver test. No certificate issuance.
2.4 SSH recording Specific recording lifecycle/setup documentation; existing recorder evidence Legacy recorder configuration, deprecated and closed to new users Existing-user transition guidance only. Do not call deprecated capability absent, or implement a new deployment from the stale general recommendation.
5.1 webhooks Console integration inventory and delivery evidence Provider webhook resource / API, signature-secret receiver contract Document ownership/authentication/replay/retention obligations. No new receiver or credential work requested; existing audit collector remains the retained-event path.

Conflicts, defaults and source limits retained