The SSH tunnel broke at 2:14 a.m., and no one noticed until morning. By then, audit logs were a mess, and access patterns were blurred. The bastion host had done its job—sort of—but it was clear the job itself was flawed. Too much access had been granted for too long. Least privilege was just a checkbox in policy, not in reality.
Bastion hosts have been the default for years. One machine, one gate. But the model forces you to give broad credentials to people and services that don’t need them. Even if users only connect for a minute, they often get privileges that linger, waiting to be misused—by accident or by attack. Scaling that pattern creates hidden risk.
The problem isn’t only security. It’s velocity. Bastion host workflows slow deployments, delay debugging, and require constant key rotation. Every operational step through a bastion adds friction. And every point of friction gets bypassed over time, usually in ways that are less secure.
An alternative is to integrate least privilege directly into every access operation, without sending users through an always-on jump host. Modern systems remove the permanent trust model and replace it with ephemeral, scoped credentials that expire automatically. Users get only the permissions—and the system reach—they need for the task at hand, for only as long as they need it. Nothing more.