An offboarded contractor left a CI pipeline that still launches a background worker every time a pull request lands. The worker authenticates with a long‑lived service account, spins up a temporary container, and then calls another internal service that spawns a second container. Before anyone notices, three nested agents are running, each with the same credentials, each able to reach the database and the internal API.
This pattern of agents calling agents – an agent loop – is a common source of agent sprawl. Teams often treat automation as a one‑off task and forget to audit the chain of processes that keep executing after the original request finishes.
Why agent sprawl happens
Most organizations grant service accounts broad, static permissions so that a single script can perform many tasks. When that script is reused across pipelines, jobs, or ad‑hoc tools, the same credential propagates through every downstream call. Because the credential never changes, each new agent inherits the full privilege set of its parent. Over time the number of active agents multiplies, and the visibility into who actually touched a resource disappears.
What identity‑centric fixes miss
Moving to non‑human identities, federated OIDC tokens, or least‑privilege roles is a necessary first step. It tells the system *who* is making a request and limits what a single token can do. However, without a control point on the network path the request still reaches the target directly. No audit log records the exact command, no inline mask hides sensitive fields, and no approval workflow can interrupt a rogue loop. In other words, identity alone does not stop the proliferation of agents.
hoop.dev as the enforcement point
Enter hoop.dev, a Layer 7 gateway that sits between identities and infrastructure. By proxying every connection – whether it is a database session, an SSH command, or a Kubernetes exec – hoop.dev becomes the only place where enforcement can happen. hoop.dev records each session, masks sensitive response fields, and can require just‑in‑time approval before a potentially dangerous command proceeds. Because the gateway holds the credential, the agent never sees the secret, breaking the chain that fuels sprawl.