The tailscale client can be queried to convert from tailscale ip to email. This could be used to track who is using the VPN service and to sign them into the protected web app. Grafana allows header auth params for example