> When a user establishes a TCP session through Boundary, a Boundary worker node seamlessly proxies the connection.

Boundary sounds like the perfect mash-up of Google's bastion-less SSH access to GCE instances and actual IAM. Exciting!