That's the problem. Tailscale is not zero trust. Tailscale can be used to implement a zero trust architecture, with if deployed with sufficiently granular ACLs, but the most common deployment is machine-oriented, rather than service or request oriented. In which case, any process on that machine has a lot of access.
Tailscale calling itself zero trust might be what leads users to think "use Tailscale, job done".
I think Tailscale know that, which is why they barely mention locking down access ACLs.
That's the problem. Tailscale is not zero trust. Tailscale can be used to implement a zero trust architecture, with if deployed with sufficiently granular ACLs, but the most common deployment is machine-oriented, rather than service or request oriented. In which case, any process on that machine has a lot of access.
Tailscale calling itself zero trust might be what leads users to think "use Tailscale, job done".
I think Tailscale know that, which is why they barely mention locking down access ACLs.