Where Tailscale VPN ends and Tailscale PAM begins

Tailscale PAM, now in beta, adds granular access controls, session logging and recording, and credential injection on top of your Tailscale VPN.