Many teams assume that handing an AI coding agent a service account automatically guarantees least privilege. The reality is that the agent still inherits whatever permissions the account carries, and those permissions are often far broader than the single task the AI is asked to perform.
Why AI coding agents break the least‑privilege promise
AI coding agents run code on behalf of engineers. To talk to a Kubernetes cluster they need an identity – usually an OIDC token or a static service‑account key. The setup phase decides which identity the agent receives and whether the token is limited to a namespace, a set of verbs, or a particular resource type.
In practice, teams often grant the agent a cluster‑admin role or a wildcard token so that the AI can explore the API without hitting permission errors. That shortcut defeats the principle of least privilege: the agent can list all pods, read secrets, and even modify RBAC rules, even if the immediate request is only to generate a deployment manifest.
The missing enforcement layer
Even when the token is scoped, the request travels directly from the agent to the Kubernetes API server. At that point the data path provides no opportunity to inspect the command, require an approval, or record the exact payload. The request reaches the target unmediated, meaning there is no real audit of what the AI actually executed, no inline masking of secret fields in responses, and no way to block a dangerous verb like delete on a critical namespace.
So the precondition we fix – tighter token scopes – still leaves the core problem unsolved: the gateway that could enforce least privilege at runtime is missing.
Putting a gateway in the data path
What you need is a Layer 7 gateway that sits between the AI agent and the Kubernetes API. The gateway must be able to read the identity token, map groups to fine‑grained policies, and apply those policies to every API call.
This is exactly what hoop.dev provides. hoop.dev runs a network‑resident agent inside your environment and proxies all Kubernetes traffic. Because it occupies the data path, hoop.dev can enforce least privilege in real time.
Enforcement outcomes delivered by hoop.dev
- hoop.dev blocks any API request that falls outside the declared policy, preventing an AI agent from deleting a namespace it was never authorized to touch.
- hoop.dev requires a human approver for privileged verbs such as create on cluster‑role bindings, turning an otherwise silent operation into a documented decision.
- hoop.dev records every Kubernetes session, so you can replay the exact series of kubectl calls the AI performed.
- hoop.dev masks secret fields in API responses, ensuring that a downstream log or screen capture never leaks a pod’s credentials.
- hoop.dev never exposes the underlying service‑account key to the AI; the credential stays inside the gateway.
All of these outcomes exist only because hoop.dev sits in the data path. The initial identity check (the setup) tells hoop.dev who the request is, but hoop.dev is the only component that can actually enforce the policy, record the activity, and apply masking.
Getting started
Deploying hoop.dev is a matter of running the provided Docker Compose file or installing the Helm chart in your cluster. The quick‑start guide walks you through configuring OIDC authentication, registering a Kubernetes connection, and defining a least‑privilege policy that matches your organization’s needs.
For detailed steps, see the getting‑started documentation. The broader feature set, including policy authoring and session replay, is covered in the learn section.
FAQ
Do AI coding agents still need credentials?
Yes. They need an identity to talk to Kubernetes, but hoop.dev protects that credential and enforces the least‑privilege boundaries on every request.
How does hoop.dev enforce least privilege on Kubernetes?
hoop.dev inspects each API call, matches it against a policy derived from the caller’s groups, and either allows, blocks, or routes the request for approval before it reaches the API server.
Will adding hoop.dev add noticeable latency?
The gateway operates at the protocol layer and adds only minimal overhead compared with the security and audit benefits it provides.
Take the next step
Explore the source code, contribute improvements, or spin up your own instance of hoop.dev at https://github.com/hoophq/hoop.
