Putting access controls around GitHub Copilot: database access for AI coding agents (on AWS)

When GitHub Copilot can fetch and write data to a database without exposing credentials, and every query it runs is auditable, you have a secure AI‑assisted development pipeline that enforces strict database access controls.

In practice many teams let the Copilot extension run against a shared database user that lives in a secret store, or they embed static credentials in CI pipelines. The AI agent then issues SELECT, INSERT or UPDATE statements as if it were a human developer, but the request bypasses any runtime guardrails. No one can tell which query altered production data, and sensitive columns such as SSN or credit‑card numbers are streamed back in plain text.

What you really need is a non‑human identity that can be granted the minimum set of permissions required for a given task, and a place where every request can be inspected before it reaches the database. The identity layer alone can enforce who is allowed to start a session, but without a gateway sitting in the data path the request still travels straight to the database engine. That leaves the core problems unsolved: no query‑level audit, no inline masking of PII, and no just‑in‑time approval for risky commands.

Introducing hoop.dev as the data‑path gateway

hoop.dev solves this gap by acting as a Layer 7 identity‑aware proxy that sits between the Copilot‑driven agent and the database. The gateway authenticates the AI service via OIDC, receives a scoped service account, and then proxies the SQL traffic through its internal agent that runs inside the same network as the database. Because the connection is forced through hoop.dev, the platform can enforce every control point that matters for database access.

How hoop.dev enforces database access policies

hoop.dev records each session, storing a complete log that can be replayed for forensic analysis. It can mask sensitive fields in query results according to patterns you define, so that PII never leaves the gateway in clear text. When a query matches a high‑risk signature, such as DROP TABLE, ALTER USER, or a bulk UPDATE that touches more than a thousand rows, hoop.dev pauses the request and routes it to a human approver before execution. The same gateway can enforce just‑in‑time windows, automatically revoking the credential when the approved time expires.

Because hoop.dev holds the database credential, the AI agent never sees the secret. The agent presents only an OIDC token, and hoop.dev validates the token against your identity provider, extracts group membership, and decides whether the request is allowed. All enforcement outcomes, audit, masking, approval, session recording, exist only because hoop.dev sits in the data path.

Benefits for AI‑assisted development

• Reduced blast radius: the AI can only run commands that have been explicitly approved.
• Full visibility: every query is logged and can be replayed, satisfying internal governance and external audit requirements.
• Privacy protection: inline masking prevents accidental leakage of regulated data.
• Least‑privilege service accounts: the AI identity is granted only the permissions needed for the current task.

Getting started

To try this pattern, follow the getting started guide that walks you through deploying the hoop.dev gateway, configuring an OIDC provider, and registering a PostgreSQL (or MySQL) connection. The feature documentation explains how to define masking rules, approval workflows, and session‑recording settings. All of the source code and example manifests are available in the open‑source repository at github.com/hoophq/hoop.

FAQ

Is hoop.dev compatible with the AWS‑hosted databases that Copilot typically uses?

Yes. The gateway can proxy connections to Amazon RDS, Aurora, or any self‑hosted PostgreSQL/MySQL instance reachable from the network where the hoop.dev agent runs.

Can I limit the AI agent to read‑only access and still get masking?

hoop.dev lets you assign a read‑only role to the service account and apply inline masking to the result set. The same policy framework works for both read and write operations.

How does hoop.dev handle credential rotation?

The gateway stores the database credential internally and can be reconfigured without exposing the secret to the AI agent. When you rotate the password in the database, you update the connection definition in hoop.dev and the change takes effect immediately for new sessions.