{
  // Small deny-by-default-ish pilot policy for the household tailnet.
  // Expand only after John + Manndra + one tagged service node validate cleanly.

  "groups": {
    "group:admins": ["fizzlepoof@"],
    "group:vip": ["manndra@"]
  },

  "tagOwners": {
    "tag:infra": ["group:admins"],
    "tag:apps": ["group:admins"],
    "tag:admin": ["group:admins"]
  },

  "acls": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": [
        "tag:infra:*",
        "tag:apps:*",
        "tag:admin:*"
      ]
    },
    {
      "action": "accept",
      "src": ["group:vip"],
      "dst": [
        "tag:apps:*"
      ]
    }
  ],

  "ssh": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["tag:infra"],
      "users": ["autogroup:nonroot"]
    },
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["tag:admin"],
      "users": ["autogroup:nonroot"]
    }
  ]
}
