On their site: "Shared machines do not advertise subnets to the tailnets they're shared into, while inviting external users into your tailnet will give them access to subnet routers."

Hey, sorry to necro this thread and bother you but someone shared your reply in a topic I just created. I read the sharing page but was a bit confused because in the "Sharing and Access Control Lists" section it reads:

When a user accepts a share, the user can make outbound requests to the shared machine, which will adhere to any ACLs defined in the tailnet that owns the shared machine.

Does that mean that we can still enforce ALCs on nodes or shared machines when sharing them individually, or does a user still need to be part of the entire tailnet to see advertised routes?

What about adding the same machine to another TS account? The thing is that previously I used my Wireguard server to acces the cameras and devices in my office, but my new ISP is behind CGNAT and I lost access to my VPN. With Tailscale I'm able to see the subnet of the cameras, but I need that in my wife's cell phone. Sorry for the ignorance, I'm just starting to use Tailscale and reading the docs I couldn't understand exactly the use cases of sharing a node.