A reranking service that can hand an auditor a complete ISO 27001 evidence package looks like this: every model update, data lookup, and operator action is logged, approvals are recorded, and sensitive fields are masked. The organization can point to a single, immutable audit trail that proves compliance with the standard’s access‑control and logging requirements.
Current reality in many ML teams
Most reranking pipelines are built as ad‑hoc scripts that connect directly to a database or a vector store using a shared credential. Engineers often copy a password into a notebook, store it in a CI secret, or embed it in a container image. The connection bypasses any central control point, so the organization cannot answer basic questions: who ran the query, which rows were returned, or whether a privileged command was issued. No session is recorded, no approval step exists, and no masking is applied to personally identifiable information that may appear in query results. The audit logs that do exist are scattered across application logs, cloud‑provider metrics, and occasional manual notes.
What the gap looks like after basic identity controls
Introducing federated identity (OIDC or SAML) and assigning each engineer a least‑privilege role is a necessary first step. The identity provider can now attest who initiated a request, and the role can restrict which resources are reachable. However, the request still travels straight to the database or the inference service. Because the enforcement point is missing, the system cannot enforce command‑level policies, cannot mask returned PII, and cannot capture a replayable record of the interaction. In other words, the setup tells you *who* tried to access, but it does not tell you *what* they actually did, nor does it give you the evidence required by ISO 27001 clause A.12.4 (logging) or A.9.2 (access control).
hoop.dev as the data‑path enforcement layer
hoop.dev is a Layer 7 gateway that sits between the authenticated identity and the target infrastructure. It proxies connections to databases, SSH hosts, Kubernetes clusters, and HTTP services. Because every packet passes through the gateway, hoop.dev can apply the controls that ISO 27001 expects:
- Session recording: hoop.dev records each reranking query and its response, storing a log that can be reviewed during an audit.
- Inline masking: Sensitive fields such as user identifiers or credit‑card numbers are redacted in real time before they reach the analyst or downstream system.
- Just‑in‑time approval: High‑risk operations, such as bulk updates to ranking scores, are paused for a manual approval step, creating an auditable approval record.
- Command blocking: Dangerous commands (for example, DROP TABLE or DELETE FROM) are intercepted and rejected, preventing accidental or malicious data loss.
All of these outcomes exist only because hoop.dev occupies the data path. The identity provider still decides *who* may start a session, but hoop.dev is the only place where the organization can enforce policy and generate evidence.
Mapping ISO 27001 clauses to hoop.dev artifacts
ISO 27001 requires demonstrable controls for access management, monitoring, and protection of information. The following table shows how hoop.dev satisfies each relevant clause for a reranking workflow: