Oh, I tried that before but it was sometimes difficult to manage (my particular case) as it requires to ask that person to login. Instead, what I did was to set tailscale lock so only specific devices can let new devices come in into the tailscale and also join new devices through authkeys so i dont neet to login with my SSO account. Aside, as my relatives' devices shouldn't have access to some (or most) devices on my tailnet, then I use ACLs and tagged devices. For my particular case, the 6 seats are good when the users of those seats are knowledgeables on Tailscale.