Agent capability is outpacing agent governance. Models generate correct SQL, invoke APIs, and modify infrastructure — but the permission model for letting them do so safely in production does not exist at most organizations.

The failure mode is not hallucinated code. It is correctly-generated destructive operations executed without authorization: DROP TABLE, TRUNCATE, bulk deletes, credential rotation. The agent works exactly as designed; the problem is that "as designed" includes operations no human reviewer approved.

These are distinct and non-redundant. A complete architecture uses all three.

hoophq/hoop (v1.82.1, Go, 706 stars, YC-backed) is a layer 7 gateway that parses wire protocols natively:

• Databases: PostgreSQL, MySQL, MSSQL, MongoDB, DynamoDB, Oracle, Redis
• Runtime: Kubernetes (kubectl), SSH, HTTP/gRPC, RDP
• AI/agent: MCP server, Claude Code, Cursor

Policy primitives:

• Block by content: DROP TABLE, DELETE without WHERE, rm -rf, kubectl delete namespace, custom patterns
• Mask by ML classification: PII, PHI, PCI — classified by context, not regex
• Approval workflow: route risky operations to Slack/Teams, time-bound
• Fail-closed: unknown operations denied by default
• Latency: under 5ms for inline blocking/masking

hoop acts as both Policy Decision Point and Policy Enforcement Point at the wire level. The caller's tooling connects through the gateway without modification — no SDK, no plugin.

These answer authorization questions when asked. None operate as transparent wire-level proxies. They require the application (or MCP server) to be the Policy Enforcement Point.

There is no widely-adopted open-source project doing SQL-level destructive query blocking as a standalone Postgres wire-protocol proxy outside hoop.

• PgBouncer: connection pooler only, no SQL filtering
• Supavisor: Elixir connection pooler, no query filtering
• pgaudit: logging at extension layer (audit, not enforcement)
• PlanetScale branching: schema-change safety via workflow, not runtime
• Cloudflare Hyperdrive: connection pooling and caching, no policy

A narrower entry point: a sidecar in front of PostgreSQL that blocks destructive DDL and unbounded DML.

Concrete operations to intercept:

• DROP TABLE, DROP DATABASE, TRUNCATE
• DELETE without WHERE clause
• UPDATE affecting >N rows (configurable threshold)
• ALTER TABLE DROP COLUMN
• Any DDL in production outside a migration window

A live demo showing an agent attempting TRUNCATE users and being blocked at the wire is more compelling than a slide deck about policy engines.

Distinct mechanisms, complementary:

• Guardrails operate inline on operations an agent attempts. Block DROP TABLE before it reaches the database.
• Sandboxes bound the blast radius of operations that succeed. The agent runs in an isolated VM/jail; damage is contained.

exe.dev is a VM provider (hypervisor-level isolation, HTTPS access). Same tier as Modal, Fly.io, E2B — compute isolation, not operation-level policy. The agent-relevance is that untrusted agent code runs in a discardable VM. Not a guardrail product; a sandbox product.

The March 2026 AI Tinkerers Boston meetup included a presentation by Will Sergeant: Agentic Trust in the Age of Dangerously Skipping Permissions.

Central thesis: current agentic frameworks operate with session-wide permission grants at startup. No per-operation scope, no task-level boundary, no least-privilege scoping within a session. "Dangerously skipping permissions" is the default posture, not a misconfiguration.

Failure modes identified:

• Tool-call injection: malicious document content triggers tool execution
• Credential exposure: agents read .env and .ssh as routine I/O
• Audit trail gaps: agentic decisions absent from app logs (HIPAA/SOC 2)
• Multi-agent lateral movement: compromised sub-agent poisons orchestrator

The presentation observed that every other demo at the meetup (dark factories, drone control, code pre-review) assumed a permission model that was either absent or trivially bypassable. "Nobody asked about fail-safes in Q&A" during the drone demo.

The AI Infra track at Tech Week Boston 2026 covers adjacent topics.

• Agent Isolation with FreeBSD Jails — OS-level sandboxing for compute
• Agent Sandbox Architectures — comparison across compute, filesystem, network, secret custody
• Agent Identity and Attestation — who is the agent acting as
• Walsh-Research Bot Compliance Spec — outbound agent behavior rules