The Bastion – Authn/Authz, traceability and auditability for SSH accesses

I found this while looking for a good option for centralizing management and monitoring of access controls for my small hosting services now that my "staff" is expanding with things like Hermes agents. I found Teleport to be a little too enterprise-y, and didn't want to mess with any custom CA servers or DNS tricks.

This appears to be getting regular updates, the project is hosted on OVH's GitHub. Anyone have any experience with The Bastion, or have any alternatives to recommend? I'd imagine a fair many of you are vibe-coding similar utilities at this point, but I thought this struck a nice balance between shooting from the hip, and full-on enterprise access control platforms.

I'd also appreciate any advice on keeping the machines contained in their own sandbox. My work requires using agents with access to development infrastructure, and I currently keep everything behind a ZeroTier VPN with no public access allowed in/out by default (individual MCP's can request approval for one-off web searches and things like CURL requests to public URLs). I've tried to be very careful about keeping secrets off the agent's machines, and only providing them with narrowly-scoped SSH keys to other dev machines on the same subnet.

But I understand there are mechanisms for agents to escape this kind of setup, and while I'm not an AI doomer, I want to be responsible with what seems to be an increasingly powerful and potent tool. To be clear, I'm also not an AI booster. The entire industry, the people leading the largest companies, the incestuous financing, the politicking, and the shaky development of hesitant regulatory frameworks all make me deeply ambivalent. I'm just a guy trying his best to ply his trade as a freelance I.T. consultant in an increasingly uncertain environment. Hope this finds everyone well. Thanks in advance if anyone reads this and/or responds.