# JIT access with Sym

Last validated Dec 4, 2025

> **Warning:**
>
> Sym announced that they will be shutting down in April 2024.

[Sym][xt-symops] is a security and access workflow platform that lets you manage just-in-time access to your Tailscale resources.

On-demand access to Tailscale resources can be provisioned using Sym. This works by adding and removing members from [groups][kb-policy-syntax-groups] defined in Tailscale [access control policies][kb-access-control].

> **Note:**
>
> Sym will use a user's Slack email address in Tailscale access control policies. If the user's Tailscale email is different from the email used by Slack, you will need to use the `symflow` CLI to manage the user identity.

## Prerequisites

Before you begin this guide, you'll need a tailnet with at least one device and a Sym account.

* For information about creating a tailnet, refer to the [Tailscale quickstart][kb-install].

* For information about creating a Sym account, refer to [Getting Started with Sym][xt-symops-start].

## Integration

For the full set of instructions, refer to Sym documentation for [setting up a Tailscale access target][xt-symops-deploy]. To use Sym with Tailscale, you'll need to:

1. Generate a Tailscale [API access token][kb-api] from the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console. Then, [share this API access token with the Sym Runtime][xt-symops-secrets].
2. In Sym, define a `sym_integration` resource with `type = tailscale`.
   1. Set the `external_id` to your tailnet ID. You can find your tailnet ID in the [General](https://login.tailscale.com/admin/settings/general) page of the admin console.
   2. Set the `api_token_secret` to the `sym_secret` referencing your Tailscale API access token.
3. Define which groups you'd like to manage access to in Tailscale. In Sym, define a `sym_target`
   resource with `type = tailscale_group`, and specify the `group_name` that appears in [access control policies][kb-access-control], for example, for
   `group:prod` in Tailscale access control policies, specify `group_name=prod` in Sym.

## Example configuration

When configuring Tailscale to work with Sym, you will need to set up groups that Sym can add users to and
remove users from as their access is granted or revoked.

Use [tags][kb-tags] when adding servers to your Tailscale network, so that their access is based on their
purpose. Then, you can allow [groups][kb-policy-syntax-groups] to have access to certain tags in Tailscale access control policies. You can also make a
group a [tag owner][kb-policy-syntax-tag-owners] if they should be able to manage tagged devices.

For example, if you want the SRE team `group:sre-prod` to be able to SSH into production servers with `tag:prod`,
you can set up a configuration like:

```json
{
  // This is the group that we will add/remove user to/from
  "groups": {
    "group:prod": []
  },
  // This allows users from the prod group to list tailnet resources with the "tag:prod".
  "grants": [
    {
      "src": ["group:prod"],
      "dst": ["tag:prod"],
      "ip": ["*"]
    }
  ],
  // This allow users from the prod group to connect to instances with the `tag:prod`
  "ssh": [
    {
      "action": "accept",
      "src": ["group:prod"],
      "dst": ["tag:prod"],
      "users": ["ec2-user"]
    }
  ],
  "tagOwners": {
    "tag:prod": ["group:prod"]
  }
}
```

Now when an SRE needs to access production, they can use the [Sym Slack integration][xt-symops-overview] to request temporary access to SSH into production, and Sym will update the [tailnet policy file][kb-policy-syntax] to allow the temporary access.

[kb-access-control]: /docs/features/access-control

[kb-policy-syntax-groups]: /docs/reference/syntax/policy-file#groups

[kb-policy-syntax-tag-owners]: /docs/reference/syntax/policy-file#tag-owners

[kb-policy-syntax]: /docs/reference/syntax/policy-file

[kb-api]: /docs/reference/tailscale-api

[kb-install]: /docs/how-to/quickstart

[kb-tags]: /docs/features/tags

[xt-symops-deploy]: https://docs.symops.com/docs/tailscale#add-tailscale-access-targets

[xt-symops-overview]: https://docs.symops.com/docs/sym-overview

[xt-symops-secrets]: https://docs.symops.com/docs/share-secrets-with-the-sym-runtime

[xt-symops-start]: https://docs.symops.com/docs/getting-started

[xt-symops]: https://symops.com