Tailscale Grants Matrix

Reads the grants block of a Tailscale policy file and produces a matrix of source and destination pairs. Grants replaced acls as the way to express access and carry two different things at once: ip, the protocol and port capabilities, and app, named application capabilities whose values the receiving application interprets. Reading grants as a rule list hides the thing that matters, because the same pair may appear in several rules and what a peer may finally do is the union of all of them. This tool computes that union per pair, but the union alone is not a safe summary, so every contributing rule is also listed with its own capabilities beside its own posture: a pair reached by tcp:22 behind a device posture and tcp:443 without one is not a pair where both ports are open unconditionally. Grants have no deny form, so the matrix is additive by construction: nothing later in the file takes access away. Group sources are expanded from the same file, and an ipset: reference is checked against the file's own ipsets block, so an undeclared one is reported as a typo rather than assumed valid; its addresses are not expanded. tag:, autogroup:, and svc: references are labelled but not enumerated, because what they contain lives in the coordination server. A svc: reference is a Tailscale Service, which is a destination-only selector: it is classified and reported as invalid when a grant uses it as a source, but whether the service exists, is advertised, or is approved is never checked. srcPosture is carried through per contributing rule rather than dropped, because a grant gated by a device posture is conditional access and must not read as open access. A grant's effective posture is its own srcPosture when it declares one, and the policy's top-level defaultSrcPosture otherwise — so a grant naming no posture is not unconditional in a policy that sets a default. An empty or null srcPosture leaves the grant without conditions of its own, so the default applies there too. Where several grants cover the same pair, each rule's own posture is shown next to that rule's capabilities, and a pair also covered by a grant with no effective posture is called out: grants are additive and have no deny form, so that one rule's capabilities are ungated, while the gated rule's capabilities remain gated. The posture rules themselves are defined in the postures block and are not evaluated here. A grant destination is used whole and never split on its colon — unlike an ACL destination, its ports are in ip, so tag:prod is the destination, not a host named tag on port prod. App capability names are listed but their values are not: a capability's value is a free-form object that only the receiving application defines, and displaying it as if it meant something here would be misleading. Policy files are HuJSON, so comments and trailing commas are accepted. Nothing is uploaded, stored, logged, or placed in the URL, and no tailnet or API is contacted, so the matrix reflects the file and not live device state.