An offboarded contractor’s CI job still runs every night, opening a PostgreSQL connection through a nested agent that lives inside the production network. The job writes logs, pulls data, and exits without a human ever seeing the credentials. Because the pipeline is automated, the stale access often goes unnoticed until a security audit surfaces unexpected data extracts, complicating access reviews.
Understanding nested agents
Nested agents are processes that a primary gateway agent spawns to reach a target service. Instead of a single hop from the user to the database, the request travels through a parent agent, which then starts a child agent that holds the database credential and speaks the PostgreSQL wire protocol. This pattern lets automation run without embedding secrets in source code, but it also creates an extra layer that is invisible to traditional access‑review tools. The child agent inherits the credential from the gateway, not from the original user, so the observable connection chain is longer than it appears.
Why access reviews become tricky
Typical access reviews enumerate who can connect to Postgres and what role they hold. When a nested agent is involved, the reviewer sees only the parent identity – the CI service account – and may miss the fact that the child agent can issue any query allowed by the stored credential. The indirect path means that revoking the parent token does not automatically stop the child agent if its credential persists in the gateway’s store. Audit logs that capture only the outermost TCP handshake hide the inner query stream, making it hard to prove that a privileged command never ran.
What to watch for during access reviews
To keep reviews accurate, teams should watch for the following signals:
- The gateway may cache credentials that survive after you disable the parent identity.
- Automation pipelines that trigger nested agents on a schedule, especially when the schedule is managed outside of the gateway’s policy engine.
- Roles assigned to the child agent that exceed the principle of least privilege, such as superuser rights when only read‑only access is needed.
- Audit logs that often record only the outermost connection, which hides the inner query stream and any data‑masking actions.
Introducing a data‑path control plane
hoop.dev provides the data‑path control needed to surface every nested‑agent interaction. It sits between the identity provider and the PostgreSQL server, intercepting traffic at the wire‑protocol level. Because the gateway owns the credential, it can enforce policies even when a child agent is created, and it can terminate the session if a policy violation is detected.