F16-TS: Yes
Rationale
Selected network grants constrain peer access and are applied by the Tailscale clients. An external perimeter firewall is not required for this policy enforcement.
Assessment method
Primary documentation review; no runtime experiment
Source context
Tailscale documentation and WireGuard protocol description
Outstanding qualification
Documentary capability of the declared profile; no runtime, security or global-scale certification. Tailnet Lock limits key-admission trust but does not replace managed coordination.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round583.html
- round583-sources.json