Models generate correct SQL, invoke APIs, and modify infrastructure – but the permission model for letting them do so safely in production does not exist at most organizations.

The failure mode is not hallucinated code. It is correctly-generated destructive operations executed without authorization: DROP TABLE, TRUNCATE, bulk deletes, credential rotation. The agent works exactly as designed; the problem is that "as designed" includes operations no human reviewer approved.

hoophq/hoop (v1.230.2, Go, 831 stars, YC-backed) is a layer 7 gateway that parses wire protocols natively:

• Databases: PostgreSQL, MySQL, MSSQL, MongoDB, DynamoDB, Oracle, Redis
• Runtime: Kubernetes (kubectl), SSH, HTTP/gRPC, RDP
• AI/agent: MCP server, Claude Code, Cursor

Policy primitives:

• Block by content: DROP TABLE, DELETE without WHERE, rm -rf, kubectl delete namespace, custom patterns
• Mask by ML classification: PII, PHI, PCI – classified by context, not regex
• Approval workflow: route risky operations to Slack/Teams, time-bound
• Fail-closed: unknown operations denied by default
• Latency: under 5ms for inline blocking/masking

hoop acts as both Policy Decision Point and Policy Enforcement Point at the wire level. The caller's tooling connects through the gateway without modification – no SDK, no plugin.

These answer authorization questions when asked. None operate as transparent wire-level proxies. They require the application (or MCP server) to be the Policy Enforcement Point.

There is no widely-adopted open-source project doing SQL-level destructive query blocking as a standalone Postgres wire-protocol proxy outside hoop.

• PgBouncer: connection pooler only, no SQL filtering
• Supavisor: Elixir connection pooler, no query filtering
• pgaudit: logging at extension layer (audit, not enforcement)
• PlanetScale branching: schema-change safety via workflow, not runtime
• Cloudflare Hyperdrive: connection pooling and caching, no policy

A narrower entry point: a sidecar in front of PostgreSQL that blocks destructive DDL and unbounded DML.

Concrete operations to intercept:

• DROP TABLE, DROP DATABASE, TRUNCATE
• DELETE without WHERE clause
• UPDATE affecting >N rows (configurable threshold)
• ALTER TABLE DROP COLUMN
• Any DDL in production outside a migration window

• Guardrails operate inline on operations an agent attempts. Block DROP TABLE before it reaches the database.
• Sandboxes bound the blast radius of operations that succeed. The agent runs in an isolated VM/jail; damage is contained.

exe.dev is a VM provider (hypervisor-level isolation, HTTPS access). Same tier as Modal, Fly.io, E2B – compute isolation, not operation-level policy. The agent-relevance is that untrusted agent code runs in a discardable VM. Not a guardrail product; a sandbox product.

The March 2026 AI Tinkerers Boston meetup included a presentation by Will Sergeant: Agentic Trust in the Age of Dangerously Skipping Permissions.

Central thesis: current agentic frameworks operate with session-wide permission grants at startup. No per-operation scope, no task-level boundary, no least-privilege scoping within a session. "Dangerously skipping permissions" is the default posture, not a misconfiguration.

Failure modes identified:

• Tool-call injection: malicious document content triggers tool execution
• Credential exposure: agents read .env and .ssh as routine I/O
• Audit trail gaps: agentic decisions absent from app logs (HIPAA/SOC 2)
• Multi-agent lateral movement: compromised sub-agent poisons orchestrator

The presentation observed that every other demo at the meetup (dark factories, drone control, code pre-review) assumed a permission model that was either absent or trivially bypassable. "Nobody asked about fail-safes in Q&A" during the drone demo.

The AI Infra track at Tech Week Boston 2026 covers adjacent topics.

• Agent Isolation with FreeBSD Jails – OS-level sandboxing for compute
• Agent Sandbox Architectures – comparison across compute, filesystem, network, secret custody
• Agent Identity and Attestation – who is the agent acting as
• Walsh-Research Bot Compliance Spec – outbound agent behavior rules

• Apollo GraphQL Summit 2026 — GraphOS Agent Services: access policy on domain-model fields rather than per tool, the gap named under MCP Authorization Gap.
• Atlassian Team '26 Europe: Smarter administration — admin controls over what humans and AI can access.
• Atlassian Team '26 Europe: Your Atlassian context in any agent — choosing MCP, A2A or direct integration.
• Atlassian Team '26 Europe: Permission to innovate — an allow, restrict, escalate exercise over AI actions.
• Atlassian Team '26 Europe: Administer Rovo — the governance problem the Rovo MCP server is meant to solve.
• Official Cybersecurity Summit Boston 2026 — Netskope: an AI Gateway and a broker for agents exposed as an MCP server, with prompt injection and jailbreak blocking; also TrendAI on MCP abuse.
• Boston AI Week 2026: The Missing Layer — an AI doing work nobody approved, and decision rights assigned per AI.