I haven’t played with tailscale, and most of my wireguard shenanigans have involved connecting to others’ systems. Wouldn’t those mostly control the network-level access but not the account-level access (centralized account/UID/gid and remote permissions) part?