Replacing the Bastion Host: Building Separation of Duties into the Core

Nothing broke. No one lost access. Security didn’t loosen—it got tighter.

Bastion hosts once stood as the single choke point between engineers and production. They were supposed to guard the gates, but over time they became liabilities. Every key, every SSH session, every sudo log ran through a single service, managed by a single team. Instead of enforcing separation of duties, they concentrated power. And concentrated power is dangerous.

Separation of duties is more than policy. It’s the principle that no single person should have the ability to perform every action in a critical workflow. In secure engineering environments, it means the person who can deploy should not be the one who can also approve, audit, and revoke. It means access must be precise, contextual, and temporary. Bastion hosts rarely make this easy. They rely on shared infrastructure, manual key management, and broad permissions. Audit logs exist but are often incomplete. Session recordings are stored but rarely reviewed.

Replacing a bastion host starts with breaking apart authority. Map out which roles need which exact access. Replace static SSH keys with ephemeral credentials that expire automatically. Enforce just‑in‑time access so no one sits on standing privileges. Tie permissions directly to identity, not to the network segment they happen to connect from. If a system supports command-level policy enforcement, use it. Make every action attributable to a single human.

Modern replacements for bastion hosts deliver this by combining identity-aware proxies, automated policy enforcement, and real-time logging. They remove the all‑powerful gateway and instead distribute control across services with layered policies. The result is stronger isolation, better traceability, and a reduced attack surface.

Security teams gain complete session visibility without the operational drag. Engineering teams get faster, safer access without the wait. The system enforces separation of duties by design, not by process docs no one reads.

The old model gave us a false sense of control. The new model delivers real control—and the freedom to grant it precisely, then take it back in seconds.

See it live in minutes. hoop.dev replaces your bastion host, builds separation of duties into the core, and gives you security without slowing you down.