diff --git a/tailscale/policy.hujson b/tailscale/policy.hujson
index 23e57f4..e737629 100644
--- a/tailscale/policy.hujson
+++ b/tailscale/policy.hujson
@@ -12,6 +12,7 @@
 	// Who may assign each tag to a device.
 	"tagOwners": {
 		"tag:subnet-router": ["autogroup:admin"],
+		"tag:sandbox":       ["autogroup:admin"],
 	},
 
 	// Routes a subnet router may advertise without manual approval. These are
@@ -51,5 +52,21 @@
 			"dst":    ["autogroup:self"],
 			"users":  ["autogroup:nonroot", "root"],
 		},
+
+		// Tailscale SSH to sandbox hosts as josh or sandbox.
+		{
+			"action": "accept",
+			"src":    ["autogroup:member"],
+			"dst":    ["tag:sandbox"],
+			"users":  ["josh", "sandbox"],
+		},
+
+		// Tailscale SSH to sandbox hosts as root, with periodic reauthentication.
+		{
+			"action": "check",
+			"src":    ["autogroup:member"],
+			"dst":    ["tag:sandbox"],
+			"users":  ["root"],
+		},
 	],
 }