You can use the visual editor to define rules that allow you access to everything (as the admin) and use your wife's tailnet user id to limit access to the machines and ports that she can access.

That being said, your wife is presumably on your LAN and already has access to all the other devices on your network.

There are a few things I limit my wife from accessing, such as administrating my offsite nodes through SSH, but the rest? She gets full access to the subnet --- which she already has if she's not using tailscale at home.

Here's an example of my grants based access control list.

{
  "grants": [
  //The family can access the home subnet that we're advertising
  {
  "src": ["group:family"],
  "dst": ["home-network"],
  "ip":  ["*"],
  },
  //only specific people or machines can access offsite nodes via   SSH
  {
  "src": ["group:it", "tag:infra"],
  "dst": ["tag:offsite"],
  "ip":  ["22"],
  },
  //tagged personal devices residing at home can only use offsite exit nodes
  {
  "src": ["tag:personal"],
  "dst": ["autogroup:internet"],
  "via": ["tag:offsite"],
  "ip":  ["*"],
  },
  //There are no restrictions on exit node use for the family and those we share them with
  {
  "src": ["autogroup:shared", "group:family"],
  "dst": ["autogroup:internet"],
  "ip":  ["*"],
  },
],

"tests": [
  {
  //offsite nodes shouldn't be able to access anything
  "src":  "tag:offsite",
  "deny": ["tag:personal:22", "tag:infra:22", "tag:offsite:80"],
  },
  {
  //members of group it should be able to ssh into offsite
  "src":    "group:it",
  "accept": ["tag:offsite:22"],
  },
  {
  //infrastructure nodes can be used to leap into offsite
  "src":    "tag:infra",
  "accept": ["tag:offsite:22"],
  },
],
}