That is something that I have yet to really figure out. I would love to have the ability to send an authz message to the machine connecting to that other machine, identd style. I also figure that this could also result in a GUI prompt to confirm it. Maybe root access over tailpam would need you to be a tailnet admin? I'm not totally sure. Still very much thinking this through.

Either way this needs a lot of work to be super secure and useful, right now it's mostly a proof of concept that has taken FOREVER because debugging PAM is so painful. There's more to come in the future, but I fully expect this to be a bit of an uphill sell to people. Writing stuff that mucks with the authentication stack is rightfully kinda scary, and there will need to be a lot of security and subject matter expert review. I expect this to be a slow burn, but good god I would love to see it happen.