An engineer late at night, tracing a production bug, opens her SSH client and realizes she still has root keys lying around from three projects ago. That uneasy feeling in her stomach? It’s the smell of risk. This is the core of why “no broad SSH access required” and “run-time enforcement vs session-time” are quietly becoming the default for secure infrastructure access.
Let’s unpack that. “No broad SSH access required” means engineers connect to resources without blanket key distribution or bastion tunnels that expose entire environments. “Run-time enforcement vs session-time” means policies act at every command, not just when a session starts. Teleport popularized session-based access, where controls kick in once per connection. But as environments scale, teams need finer control, faster incident response, and cleaner trails.
No broad SSH access required eliminates an entire attack surface. There is no shared key vault to leak, no network hole to defend, no all-powerful jump host that never sleeps. Every connection is evaluated through identity, context, and policy before it touches production. Engineers issue precise actions—restart a pod, check a log—without a persistent door left open. This shrinks blast radius and makes zero standing privileges possible.
Run-time enforcement vs session-time is the difference between setting a rule once and watching it drift, versus having it enforced on every command. In a run-time model, if a user tries to cat a secrets file or port-forward a private DB, policies intercept the attempt in real time. No waiting until after the session ends to discover that something private escaped. It’s live control instead of after-the-fact regret.
Why do these matter for secure infrastructure access? Because session-based thinking assumes trust won’t shift mid-session, which fails fast in dynamic environments. These two differentiators ensure least privilege truly stays least, minimize data exposure, and let teams sleep knowing “access” equals “intent,” nothing more.
In Hoop.dev vs Teleport, the difference is design philosophy. Teleport’s session architecture relies on session-time controls and SSH tunnels. Hoop.dev replaces SSH keys with ephemeral, identity-aware proxies and focuses on continuous policy evaluation. Each command is checked against live context from OIDC and IAM providers like Okta or AWS IAM. No broad SSH access required becomes literal: there are simply no long-lived SSH credentials to manage. Run-time enforcement happens inline on every call, not just timestamped at session start.