Restrict Tailscale tags in policy, not only in auth keys
A tagged Tailscale auth key does not restrict network reachability by itself. Tags establish device identity; the tailnet access policy still decides what that identity can reach. Before enrolling an automated workload, inspect existing broad grants, replace wildcard source acces…