One concern keeps coming up in conversations about AI infrastructure: will this still matter in six months?
The AI stack changes incredibly fast. A few months ago, MCP gateways looked like the obvious place to build controls around agents. Now harnesses are getting more attention. Models keep getting better at using existing interfaces, so people are also experimenting with CLIs, APIs, browsers, and graphical interfaces. Nobody really knows what the dominant stack will look like 12 or 24 months from now.
That makes buying infrastructure around AI unusually difficult. Why invest $100k and three months implementing a tool if the layer it governs might not matter by the time the rollout is complete?
This question is especially interesting to me because Hoop wasn't originally built for AI. It started as a privileged access management product for humans accessing infrastructure, and I built it because I was frustrated by the limitations I had while working at fintech companies.
As a developer, I often knew exactly how to solve a customer problem. I had written the code, I knew where to look, and in many cases I could diagnose the issue in seconds. But I didn't have access to production. Instead, I had to open a ticket, sometimes including a SQL statement in the comments, and wait for someone on an operations team to run it. That person usually had far less context about the customer problem than I did. Sometimes an operations team would spend hours or days investigating an issue before it eventually reached the engineer who had enough context to solve it.
It was inefficient and extremely frustrating, but what bothered me most was that the reason I couldn't get access was perfectly solvable. Security wasn't trying to make my life difficult. They had real problems with giving developers production access.
Over time, I realized those problems reduced to two things: what sensitive information can this person read, and what harmful actions can this person perform?
If you could control those two things, you could give developers much more autonomy without taking on the risks security teams were trying to avoid. So that's what we built.
At the time, most access products were very good at answering who can connect to what. Authentication, authorization, just-in-time access, audit trails. But once the connection was established, the controls became much weaker.
The controls inside the live connection were largely empty.
Hoop started enforcing policy there instead: inside the actual interaction with the database, server, or application.
AI made the same problem much bigger. The actor is no longer just a human; now it's also an agent. Agents are non-deterministic systems interacting with the same databases, servers, applications, and infrastructure humans were interacting with before.
From first principles, the security problem still looks remarkably similar. What sensitive information can the agent read? What harmful actions can the agent perform?
A lot of things we talk about as separate AI security problems are variations of these two. Data exfiltration starts with reading sensitive data. Privilege escalation ultimately enables actions the agent shouldn't be able to perform. A destructive query is a harmful action. Sending sensitive customer information somewhere it doesn't belong starts with allowing the agent to access that information in the first place.
What changes much faster is how the agent reaches those systems.
MCP became popular very quickly, and so did the idea of putting governance around MCP. Now harnesses are getting more attention. Maybe harnesses become the dominant control point. Maybe MCP remains important. Maybe agents mostly use existing CLIs and APIs. Maybe computer use gets good enough that a valuable enterprise agent simply operates Jira, SAP, or some internal application through its graphical interface.
I don't think we need to know which one wins.
If you build your security model around MCP, you're making a bet that MCP remains an important path between the agent and the resource. If you build it entirely into a harness, you're making a bet on the harness layer. That doesn't make those control points bad. They can provide useful context and controls. But they're attached to a part of the stack that is changing very quickly.
The lower you go, the more boring things get. Postgres still speaks Postgres. MySQL still speaks MySQL. Linux still exposes the interfaces software uses to interact with it. Applications still receive requests.
Somewhere, regardless of how sophisticated the agent stack becomes, an agent eventually has to interact with a real system and do something. It has to read data, write data, execute a command, or make a request. The layers above that boundary may change completely. The boundary itself changes much more slowly.
That is why we decided to anchor Hoop there.
Instead of betting that agents will use MCP, a specific harness, a CLI, or some other interface, Hoop enforces runtime controls at the boundary to the resource itself. We parse the underlying protocols, which means we can see what is actually happening inside the interaction and enforce controls there.
Higher layers still matter because they can provide useful semantic context: the agent's task, the user's intent, the tool being called, or the workflow that triggered the action. But where context comes from and where enforcement is anchored don't have to be the same place. You can bring context down from higher layers while keeping enforcement close to the resource being protected.
That gives you the richer context of the AI stack without making the security boundary dependent on one particular version of that stack.
We're still early in this transition, and I don't know exactly what the AI architecture of the next few years will look like. That's the point.
We've repeatedly heard companies say they're exploring but aren't ready to commit to certain AI infrastructure because they don't know whether today's approach will still matter six months from now. I think that's a rational concern. If you're investing in controls that need to survive the current wave of AI infrastructure, one useful question is: what does this control depend on staying the same?
For Hoop, the answer is not MCP, harnesses, CLIs, APIs, or graphical interfaces. It is the fact that agents eventually have to interact with foundational systems.
I have a lot more confidence that Postgres, MySQL, Linux, HTTP, and the systems companies already run will still exist in a few years than I do in any particular agent abstraction we're excited about today.
Hoop's value doesn't depend on which AI stack wins over the next 24 months.
The resource boundary isn't the new control point. I think it's the most durable one.