TailPermit

Who it's for

MSP and freelance IT engineers who use Tailscale or tailcat to reach client networks; today they cope with permanent ACL rules, email approvals, SSH tunnels, TeamViewer, or shared credentials.

The problem

Time: each temporary client-access request takes 15-40 minutes to open and close safely. Legal/audit: client contracts and cyber-insurance reviews demand proof of client consent, expiry, and who accessed which port.

How to build it

CLI plus web approval page, magic-link client consent flow, Tailscale API/tag automation, tailcat wrapper, and CSV/JSON signed ledger export.

How it makes money

MSPs pay about $149/month per agency because it speeds client access and produces consent/audit evidence; they cannot just use free tailcat or Tailscale ACL edits because those lack client-facing approval, automatic expiry, and a signed session ledger.

Why it doesn't exist yet

Incumbents skip: Tailscale focuses on single-org mesh networking and invites, not cross-client approval and audit workflows. Indie gap: a small team can wrap tailcat with client-facing magic-link approvals, TTL enforcement, and exportable receipts without building a VPN product.

First users

From the HN Tailcat thread, Tailscale community channels, and MSP/IT-provider groups: offer a free signed access-audit receipt for their next client incident.

Build size

1-2 people x 10 weeks; includes request API, client approval page, Tailscale tag/key automation, tailcat wrapper, append-only SQLite ledger, CSV/JSON export; excludes full identity provider, Windows/macOS agents, non-Tailscale networks, and compliance certification.

Biggest risk

Tailscale ships native client-approved temporary access grants or tailcat audit receipts, making the wrapper redundant.

Conditions for a hit (all 3 required)

• Given a request containing client device ID, port, and TTL <=60 minutes, the system creates a magic-link approval and activates a one-time tailcat grant only after the client clicks approve; unused grants expire automatically.
• If approval is missing or the grant has expired, connection attempts are refused, and the dashboard shows requester, client approver/domain, state, and timestamp for each request.
• Within 60 seconds after a session closes, the system exports a CSV/JSON receipt containing MSP engineer, client approver, device/port, start/end times, bytes transferred, and a SHA-256 hash of the record.

How it's judged (in 6 months)

Product Hunt daily top 5 for a client-approved Tailscale/tailcat temporary-access tool, or a public GitHub repository implementing the same shape with at least 1,000 stars.(judgment date 2027-02-27)

AI self-confidence 52/100 — self-reported likelihood of meeting the criterion, not a business success rate