Agents or a proxy: the access-control decision you make before you compare any features
Disclosure: I work on Tessera, which is one of the proxy-shaped tools. Both shapes are legitimate and I try to be fair to the other one below. Most comparisons of access-control tools start with feature tables. That is the wrong end. The decision that actually determines whether a rollout finishes is the deployment shape, and there are only two. Shape one: agents and certificates You run an…
When deciding between access-control tools, it’s crucial to understand the deployment shape, as this determines whether the rollout completes. There are only two shapes: agents with certificates, and a proxy model. The agents model requires a change window, change approval, and a rollback plan, which can be organizationally challenging.
This model automatically revokes credentials when they expire, eliminating the need for manual intervention and allowing the credential to scale well. However, it requires a change window and approval from those who own the hosts. The proxy model, on the other hand, keeps the credential on a controller, and the user authenticates to the controller.
The controller opens its own connection to the target, making changes easier and faster, especially in organizations that cannot easily modify production configuration. Additionally, the proxy model can enforce session-level permissions, allowing for real-time read-only enforcement and reducing the need for changes in the target system.
However, the proxy model does come with its own set of challenges, such as relying on a controller that must be operated and maintained, handling twice the traffic, and holding long-lived credentials, which can be attractive targets for attackers. Ultimately, the choice between the two models depends on two critical questions: can you change production configuration in the next quarter, and do you need to control the session or only the connection?
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.