![\"Project](\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\")
Last validated: Mar 13, 2026
\nThe visual policy editor is an alternative way to edit the human JSON (HuJSON) syntax of the tailnet policy file with an interactive graphical user interface. You can switch between the visual editor and the JSON editor anytime. Changes you make using the visual editor sync with the JSON editor when you save them.
\nYou can use the visual policy editor for the following tailnet policy file features:
\nTo make changes to the network policy options of the tailnet policy (such as derpMap, disableIPv4, OneCGNATRoute, and randomizeClientPort) you must use the JSON editor.
The visual editor translates your configuration choices into the underlying HuJSON policy file format. You can switch between the visual editor and the JSON editor at any time to work with policies in the format that best suits your needs. The bidirectional synchronization ensures that changes in either editor immediately reflect in the other. For a comprehensive understanding of the underlying policy syntax, refer to Tailscale's policy syntax documentation.
\nGo to the Access controls page of the Tailscale admin console to access the visual editor. The editor displays with the Visual editor tab selected by default.
\nThe visual policy editor supports three distinct operating modes that serve different workflow preferences and requirements. Each mode maintains full compatibility with the underlying policy file format while offering different interaction patterns.
\nacls section to equivalent grants. Refer to Migrate from ACLs to grants for more information.To prevent users from editing policies on the admin console when using GitOps, you must lock the editor. To do this, go to Policy file management > Lock editor, then enable Prevent edits in the admin console.
\nGeneral access rules let you manage access between devices in your tailnet using grants syntax.
\nManage general access rules using the visual editor.
\nTailscale SSH rules let you control SSH access to devices in your tailnet without managing SSH keys.
\nManage Tailscale SSH rules using the visual editor.
\nGroups let you organize users into logical groups for access control management. There are three types of groups: user-defined groups, synced groups from your identity provider, and built-in autogroups.
\nManage groups using the visual editor.
\nTags provide a way to authenticate and organize non-user devices like servers into functional groups for use in access control policies.
\nManage tags using the visual editor.
\nIP sets let you create collections of IP addresses, hosts, and subnets to use in access control policies.
\nManage IP sets using the visual editor.
\nHosts are a way to create friendly names for IP addresses and CIDR ranges to improve policy readability by replacing numeric addresses with meaningful identifiers.
\nManage hosts using the visual editor.
\nNode attributes let you apply settings and attributes to device to do things like control feature availability and device behavior across your tailnet.
\nManage node attributes using the visual editor.
\nDevice posture rules let you specify the requirements a device must meet before it can access sensitive resources.
\nManage device posture rules using the visual editor.
\nAuto approvers let you create policies to pre-approve specific operations for devices, such as advertising subnet routes or exit nodes, without manual intervention.
\nManage auto approvers using the visual editor.
\nTests validate that access control changes meet expected behavior before saving.
\nManage tests using the visual editor.
\nChanges in the visual editor immediately sync to the JSON editor after you save them. This bidirectional synchronization ensures consistency regardless of which editor you use.
\nGitOps mode prevents modifications to maintain version control as the source of truth. In this mode, use the visual editor to preview and validate changes before committing them to your repository. The read-only mode indicates when GitOps manages your configuration. For GitOps implementation examples, refer to the documentation for GitHub Actions, GitLab CI, and Bitbucket.
\nWhen you use the visual editor, it automatically converts ACL syntax to grants syntax on the backend. Grants syntax supports all the same capabilities as ACL syntax with additional features like route filtering and app capabilities. Refer to grants versus ACLs for more information.
\nAll major sections include search fields that filter content in real time. Search works across every visible column in a section. You can find configurations using any identifying information without switching search modes.
\nThe dropdown list arrow in search fields provides additional filtering options:
\nReal-time filtering helps manage large policy files efficiently. Type any part of a configuration to display only matching items. This approach eliminates manual scrolling through hundreds of entries.
\nThe visual editor validates your input as you work. This approach lets you work through complex configurations without interruption. Required fields appear without optional labels because they represent the baseline requirement.
\nField-specific validation errors appear near the relevant fields, while validation errors that aren't field-specific appear at the top of the page. Examples of these include failed general tests and failed SSH tests.
\nMost configurations include JSON preview panels showing the HuJSON syntax your selections generate. These previews update immediately as you modify fields. The preview helps you understand how visual selections translate to policy file syntax.
\nThe JSON preview serves several purposes:
\nThe copy button lets you copy the policy JSON to your clipboard for use in version control, documentation, or team collaboration. This feature connects visual and code-based configuration workflows.
\nJSON previews are available even when the policy file is locked because it's managed through GitOps. You can still view and copy generated HuJSON snippets for reference.
\nThe visual editor continues to evolve with regular feature additions. Your feedback helps prioritize improvements and identify issues.
\nSelect Give feedback from the top of the Visual editor page to submit suggestions, report bugs, or request features. The product team reviews all submissions and uses them to guide development priorities.
\nInclude specific use cases and workflows in your feedback. The more context you provide, the better the team can understand and address your needs. Screenshots and detailed descriptions help communicate complex issues or feature requests.
\nAsk AI
\nreCAPTCHA
\nRecaptcha requires verification.
\nprotected by reCAPTCHA
\n"}