diff --git a/ipn/ipnstate/ipnstate.go b/ipn/ipnstate/ipnstate.go
index 06559ce44..c06a6a4cf 100644
--- a/ipn/ipnstate/ipnstate.go
+++ b/ipn/ipnstate/ipnstate.go
@@ -70,6 +70,11 @@ type PeerStatus struct {
 	// etc by default.
 	ShareeNode bool `json:",omitempty"`
 
+	// ACLTags, if non-empty, are the ACL identity the node is running as.
+	// When present, the UserID is then just who created it, but doesn't represent
+	// the effective user for ACL purposes.
+	ACLTags []string `json:",omitempty"`
+
 	// InNetworkMap means that this peer was seen in our latest network map.
 	// In theory, all of InNetworkMap and InMagicSock and InEngine should all be true.
 	InNetworkMap bool
@@ -170,6 +175,9 @@ func (sb *StatusBuilder) AddPeer(peer key.Public, st *PeerStatus) {
 		return
 	}
 
+	if len(st.ACLTags) != 0 {
+		e.ACLTags = st.ACLTags
+	}
 	if v := st.HostName; v != "" {
 		e.HostName = v
 	}
diff --git a/ipn/local.go b/ipn/local.go
index 52d24e67f..44bdf930a 100644
--- a/ipn/local.go
+++ b/ipn/local.go
@@ -223,6 +223,7 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 				Created:      p.Created,
 				LastSeen:     lastSeen,
 				ShareeNode:   p.Hostinfo.ShareeNode,
+				ACLTags:      p.Hostinfo.RequestTags,
 			})
 		}
 	}