diff --git a/ssh/tailssh/tailssh.go b/ssh/tailssh/tailssh.go
index b249a1063..2c0f7804b 100644
--- a/ssh/tailssh/tailssh.go
+++ b/ssh/tailssh/tailssh.go
@@ -620,6 +620,9 @@ func (c *conn) evaluatePolicy() (_ *tailcfg.SSHAction, localUser string, acceptE
 	if !ok {
 		return nil, "", nil, noPolicy
 	}
+	polJSON, _ := json.Marshal(pol)
+	fmt.Println("evaluatePolicy: ", string(polJSON))
+
 	return c.evalSSHPolicy(pol)
 }