That’s how most breaches begin — not with some zero-day exploit, but with weak, unmanaged access. The perimeter is already gone. What’s left is your SSH door, and too often, it’s wide open. The only way forward is to treat access as code, and check every connection against policies you control and understand.
Open Policy Agent (OPA) makes that possible. It gives you fine-grained, programmable rules for SSH connections — a single place to express who can log in, from where, at what time, and for what purpose. Pairing OPA with an SSH access proxy turns every login into a policy check, enforced in real time. No static allowlists. No hard-coded keys. No guessing.
An OPA-powered SSH access proxy works as the policy brain in front of your infrastructure. A user tries to connect. The proxy asks OPA: Is this allowed? OPA evaluates the request against your policies written in Rego, its policy language. You define conditions around user identity, device security, source IP, and any context that matters to you. The decision is binary: allow or deny. Nothing else slips through.
This approach solves three common problems at once:
- Centralizing SSH authorization logic.
- Making policies explicit and version-controlled.
- Enforcing compliance without relying on manual key management.
Security teams can roll out policy updates without touching every server. Engineering leaders can audit every access event and map it to a policy decision. Adding new requirements is a simple code change, tested and pushed just like application code.
The tech stack is lightweight. OPA runs as a sidecar or separate service. The SSH access proxy sits in front of hosts or Kubernetes workloads. Policy updates are instant. Scaling to thousands of connections is straightforward, because the proxy and OPA are decoupled and stateless.
The result is more than SSH hardening. It’s a shift in how teams think about privileged access — not as an afterthought, but as a first-class part of the system. No shared keys. No dark corners. Every decision logged, every rule explainable.
If you want to stop relying on luck to protect your infrastructure, try running an OPA-based SSH access proxy now. With hoop.dev, you can see it live in minutes. Define your first policy, watch it enforce real SSH sessions, and take back control of your access layer before the next password gets taped to a monitor.