Tailscale PAM: what it adds on top of a VPN, and whether a home lab needs it

On 26 October Tailscale published an explainer on where its VPN ends and its new privileged access management (PAM) service begins. The company's own shorthand is that the VPN locks the door, while PAM records who goes through it. PAM is in beta at the time of writing, and the post gives no pricing.

What the VPN does, and what PAM adds

Tailscale's VPN builds a private mesh network, a tailnet, between your devices using WireGuard. Grants and access control lists decide who can reach which machine. If you run a home lab, you probably already use this. Our recent look at Tailscale SSH and the Tailworm findings covers one part of that picture.

PAM sits on top of that identity layer and controls access to individual services: SSH servers, databases, Kubernetes clusters, Remote Desktop sessions and web apps. According to Tailscale, it works through a PAM connector, software that runs on a machine, container or VM on the same network as the target. Clients reach the connector over a WireGuard-encrypted tunnel and the connector mediates the connection. You can run several connectors for redundancy.

The features Tailscale describes

• Per-connection authorisation: each connection is checked as it happens, not just when a device joins the network.
• Granular permissions: Tailscale's example is allowing someone to add data to a database but not delete it.
• Credential injection: the connector supplies the service credential or token, so people never see or share the password. Credentials can be rotated in the admin console or an external secrets manager.
• Temporary access: access can be granted for a limited period, such as a monthly maintenance task or a contractor.
• Logging and recording: at a minimum, who connected, from which IP address and device, and when and for how long. Optional recording covers database queries, SSH sessions (text and video replay), and HTTP, Kubernetes and S3 sessions.
• No client needed on every target: a built-in catalogue of common services means you do not have to install Tailscale on each server, and people without the client can reach some services through a browser after signing in.

Recordings are kept in Tailscale-managed storage by default. The post says customers on the Premium plan can store them in Amazon S3 to make third-party auditing easier.

Is it for a home lab?

Probably not yet, and possibly never. PAM solves problems that appear when several people need to reach shared systems: who ran that query, how do we remove a contractor's access, how do we stop a password being passed around. For one person and a few family members on a NAS and a Home Assistant box, the ordinary VPN with sensible access rules does the job.

It starts to make sense for a small business, a club or a shared server with several administrators. If you want audit trails and short-lived access, PAM is worth watching. Check the pricing page before planning around it, because the post does not say what it will cost.

What to keep in mind

• It is a beta. Features and terms may change.
• These are vendor claims. The post offers no independent audit or compliance certification for PAM.
• Recordings are sensitive data. Session recordings can capture secrets and personal information. Decide who can view them and where they are stored before switching them on, and check what that means under UK GDPR if they include other people's data.
• The connector is a new thing to secure. It holds the credentials it injects, so keep it patched and restrict who can reach it.

What to do now

If you already use Tailscale, tidy your access rules first: remove stale devices, tighten grants, and keep SSH and subnet routers updated. If you want the same discipline without a commercial service, our network-wide ad blocker comparison and Raspberry Pi buying guide show what a small self-hosted setup can look like. Revisit PAM once it leaves beta and the pricing is clear.

Source: Tailscale blog, 26 October 2026 (Where Tailscale VPN ends and Tailscale PAM begins).