Restrict Tailscale tags in policy, not only in auth keys

A tagged Tailscale auth key does not restrict network reachability by itself. Tags establish device identity; the tailnet access policy still decides what that identity can reach. Before enrolling an automated workload, inspect existing broad grants, replace wildcard source access with a human-member source when appropriate, add one exact tag-to-host-and-port grant, and encode policy tests that allow the required port while denying nearby administrative ports. Preserve unrelated grants and SSH rules. This pattern limits a workload only when no broader rule also matches it.

Applies when: A cloud workload needs one private dependency through Tailscale. Keywords: Tailscale auth key tag ACL grants autogroup member port tests