But you still can't have multiple tailnets. The strategy of "have hobbyists try out the software themselves, like it, then implement it at their work" seems incompatible with this fact.
The only way to do it is if you have secondary email address domains. Say mdeeks@company.com and mdeeks@company.team. You can create a separate tailnet for company.team but you also have to roll out additional subnet routers (if you use them) that are authed on that second tailnet. Also you wont be able to easily write rules that interact with things that are not authed onto the second tailnet.
They need a first class concept of "canary" or "beta" that applies to ACLs, DNS configs, client versions, and all sorts of other toggles in the UI. It's a hard product problem and I'm not even sure how some of it should work.
I just know I need a way to test changes before I roll it out to everyone at the company. Right now there aren't good options for that.
E.g. I have the Tailscale macos application configured for the work network and then I run another tailscale daemon to connect to other home stuff:
$ alias tailscaled
tailscaled='sudo tailscaled --socket /Users/mkm/tmp/tailscale-mkm.socket'
$ alias tailscaleI installed the tailscale binaries from sources with "go install tailscale.com/cmd/tailscale{,d}@main"
It's a pain point.
I guess companies where there's not even any identity management, securing your network via tailscale is not your primary concern.