The console ships a grants-based default policy, so an acls example forces the
operator to translate before they can use it - and the two differ in exactly
the place that matters: grants carry ports in `ip` (`tcp:9222`) rather than
suffixed onto `dst`.
Adds the three things dropping the blanket grant silently takes away: an ssh
block, since tagged devices leave `autogroup:self` and Tailscale SSH stops
resolving them; a commented `autogroup:internet` grant for exit-node users;
and `tcp:22` to the browser machine, without which tagging locks you out.
The DEPLOY §7 snippet was a bare `acls` fragment: it named tags without
declaring tagOwners, without saying how tags get applied, and without the rule
that keeps the operator's own SSH access once the blanket accept is gone.
Following it literally locks you out of the browser machine.
Also records why tagging is load-bearing rather than stylistic - Tailscale has
no deny, so excluding CDP from a selector that still covers your own devices
requires the destination to fall outside autogroup:member/self, which is
exactly what a tag does - and separates the bind proof from the ACL proof,
which the old text conflated.
sulthan