When a single privileged credential is passed through multiple nested agents, the cost of a missed revocation can explode, making access reviews a nightmare for compliance and risk teams.
Why nested agents confuse access reviews
Most organizations still rely on a handful of long‑lived service accounts or SSH keys that are copied from one host to another. An engineer may log into a bastion, launch a second‑stage agent inside a private subnet, and then spin up a third‑stage process that talks to an RDS instance. Each hop inherits the original credential, so the chain of custody disappears as quickly as the agents are created.
From an access‑review perspective this looks like a single user with blanket rights, even though the actual work is done by a cascade of automated processes. The result is twofold: first, it becomes impossible to tell which identity performed a given query; second, revoking the original credential does not guarantee that lingering agents stop acting, because they may have already cached tokens or have open connections.
The gap: no visibility into chained sessions
Even when teams adopt modern identity providers and enforce least‑privilege policies, the request still travels directly to the target database or service. The authentication step happens once, at the outermost agent, and the inner agents simply forward traffic. No layer in the stack records the intermediate steps, masks sensitive fields, or asks for approval before a risky command reaches the backend. Access reviews therefore miss the true breadth of exposure.
Putting a gateway in the data path
To close the gap, the enforcement point must sit where the traffic actually flows – the data path. hoop.dev acts as a Layer 7 gateway that proxies every connection, whether it originates from a human, a CI job, or a nested agent. Because the gateway sits between the identity provider and the AWS resource, it can enforce controls that no upstream component can provide.
When a request arrives, hoop.dev validates the OIDC token, extracts group membership, and then applies policy before the payload reaches the target. It records the full session, so a later reviewer can see exactly which identity triggered each command, even if that identity was wrapped inside several agents. The gateway can also mask sensitive columns in query results, block commands that match a deny list, and route suspicious operations to a human approver for just‑in‑time consent.