One tag for all the worker machines
A few machines in my Tailscale network run unattended. Instead of naming each one in the access rules, they carry one tag, and the rules talk about the tag: who may reach them, on which ports, who may SSH in. Adding a machine stops being a policy edit.
