Post

Do you run it in check mode for the sensitive boxes? Forcing a fresh SSO login before root feels like the sweet spot between convenient and reckless.

yeah exactly, and tsrecorder for every session. theres only a handful of "real" break-glass ssh keys and everything else is tailscale ssh

tsrecorder on every session is the part most setups skip. Do the recordings stay on a node inside the tailnet, or get shipped somewhere the hosts themselves can't touch?