Pretty sure only accessible nodes are present in netmap given to a node from headscale.

... Because I had triggered more than one alarm recently messing with a headscale upgrade and permissions involved :D