Topic starter
02/08/2026 12:05 pm
TL;DR: Nine partial downtime or slowness periods in one month were mostly resolved in under an hour, with existing data-plane connections continuing even when control-plane actions were blocked for affected users, according to Tailscale. The pattern shows why blast radius, not just uptime, is the critical reliability measure for identity-adjacent infrastructure.
Editorial analysis by NHI Mgmt Group, based on content published by Tailscale: “Hypergrowth isn't always easy”.
Key questions
Q: What breaks when a control plane goes down but existing sessions stay up?
A: The main failure is not always traffic loss.
Q: Why do control-plane outages matter so much for IAM teams?
A: IAM teams depend on the control plane for policy enforcement, approvals, lifecycle changes, and administrative trust decisions.
Q: What are the signs that blast radius is too large in a distributed access platform?
A: The warning signs are repeated incidents that affect a small subset of users but still block essential actions, long recovery times for control changes, and restart behaviour that depends on live coordination.
Practitioner guidance
- Define control-plane failure scopes Map which identity and access actions stop during a coordination outage, including device approval, ACL changes, and node lifecycle changes.
- Test restart recovery behaviour Verify whether clients, agents, or workload connectors can restart and rejoin without live coordination.
- Measure blast radius by action type Track outage impact by blocked administrative functions, not only by service-wide availability.
Bottom line: The article shows that a partial outage can be operationally serious even when existing connections continue to work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:10 pm
Blast radius is the real reliability metric for identity-adjacent infrastructure. Uptime numbers flatten very different failure modes into one figure, which hides whether access, policy changes, or approvals are actually blocked. In this case, the service design preserved many active connections while limiting the outage to specific coordination actions, which is materially different from total loss of service. Practitioners should treat containment, not raw uptime, as the more meaningful measure of operational resilience.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations design for control-plane failure without losing access continuity?
A: They should separate data-plane continuity from control-plane dependence, cache enough state to survive brief interruptions, and define which access actions can safely continue offline. The best models fail closed for risky changes but keep existing sessions alive where appropriate. That balance reduces disruption while keeping governance boundaries explicit.
👉 Read our full editorial: Tailscale’s control-plane outages show why blast radius matters