{
  "id": 4804287,
  "title": "Agents or a proxy: the access-control decision you make before you compare any features",
  "url": "https://urgent.news/2026/09/01/agents-or-a-proxy-the-access-control-decision-you-make-before-you",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T06:46:31.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/alektoreef/agents-or-a-proxy-the-access-control-decision-you-make-before-you-compare-any-features-92c"
  },
  "original_language": "en",
  "account": "When deciding between access-control tools, it’s crucial to understand the deployment shape, as this determines whether the rollout completes. There are only two shapes: agents with certificates, and a proxy model. The agents model requires a change window, change approval, and a rollback plan, which can be organizationally challenging. This model automatically revokes credentials when they expire, eliminating the need for manual intervention and allowing the credential to scale well. However, it requires a change window and approval from those who own the hosts. The proxy model, on the other hand, keeps the credential on a controller, and the user authenticates to the controller. The controller opens its own connection to the target, making changes easier and faster, especially in organizations that cannot easily modify production configuration. Additionally, the proxy model can enforce session-level permissions, allowing for real-time read-only enforcement and reducing the need for changes in the target system. However, the proxy model does come with its own set of challenges, such as relying on a controller that must be operated and maintained, handling twice the traffic, and holding long-lived credentials, which can be attractive targets for attackers. Ultimately, the choice between the two models depends on two critical questions: can you change production configuration in the next quarter, and do you need to control the session or only the connection?",
  "summary": "Disclosure: I work on Tessera, which is one of the proxy-shaped tools. Both shapes are legitimate and I try to be fair to the other one below. Most comparisons of access-control tools start with feature tables. That is the wrong end. The decision that actually determines whether a rollout finishes is the deployment shape, and there are only two. Shape one: agents and certificates You run an…",
  "key_points": [
    "Two deployment shapes: agents with certificates vs. proxy model",
    "Agents model requires change window, approval, and rollback plan",
    "Proxy model keeps credential on controller, enforces session-level permissions"
  ],
  "editors_take": "The choice between an agent or proxy model for access control determines the ease of deployment, maintenance requirements, and security implications, ultimately shaping an organization's flexibility and risk exposure.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}