INFRA Signal 493
Tailscale PAM beta: Manage connectivity and privileged access in one place
↗
Tailscale PAM beta adds just-in-time access, resource-level policies, and session auditing to the admin console, merging connectivity and privileged-access management.
By granting access only when needed and limiting it to specific resources, the beta helps reduce standing privileged accounts that are a common attack surface. Unified management in the Tailscale console removes the need to switch between separate tools for network connectivity and access control, streamlining workflows for engineers. Session logs and recordings provide auditable evidence that can simplifyify compliance reviews and incident investigations.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Just-in-time access lets users request temporary permissions via Slack, with approvals scoping access to a single resource for a defined period.
Resource-level policies enable administrators to define who can access each database, server, Kubernetes cluster, or web application and under what conditions.
Session logging and recording capture who accessed what and when, supporting audits and post-incident analysis for supported protocols.
THE READ
What the cluster adds up to.
Tailscale introduced PAM beta integrating privileged access management with its existing network connectivity platform, offering just-in-time access, resource-level policies, and session auditing via the admin console. The feature builds on the earlier Border0 + Tailscale integration that gave identity-aware, credential-free access. Now the capability is packaged as a dedicated Tailscale product managed from the same console used for network connectivity.
Adopting PAM beta requires deploying Tailscale connectors inside the private environment to broker connections to target resources. Administrators then define individual services such as databases, Kubernetes clusters, or web applications and attach policies that specify who can access them, when, and with what permissions. Approval workflows can be linked to Slack for just-in-time requests, eliminating the need to distribute shared credentials or install separate client software on each resource.
Session logging and recording, which provide the audit trail, are only available for protocols that Tailscale PAM explicitly supports, such as SSH, Kubernetes API, database clients, RDP, and browser-based access. For other systems or custom protocols that lack these hooks, administrators must rely on network-level logs instead of detailed session records. Because the offering is still in beta, some features present in the standalone Border0 solution may be missing or subject to change before general availability.
The announcement appears in a single feed, the official Tailscale blog, with no independent reports to confirm the exact scope or performance of the beta. Engineers evaluating the feature should therefore treat the described capabilities as preliminary and verify them in a test environment before relying on them for production workloads. Future feeds may add details about pricing, general availability timelines, or integration with other identity providers.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER