Teleport Provides Unified Infrastructure Access. Access Control Is Not Cryptographic Governance.
by Nick Clark | Published March 28, 2026
Teleport provides unified access to SSH servers, Kubernetes clusters, databases, and web applications with certificate-based identity, session recording, and access requests. The unified access layer is well-designed. But Teleport controls who can access what. It does not cryptographically govern what operations are performed within authorized access sessions. A user with SSH access can run any command. A user with database access can run any query. Access control is not the same as operation governance. The gap is between unified access control and cryptographic governance of operations.
Teleport's unified access platform with certificate-based identity and session recording provides genuine security infrastructure. The gap described here is about governing operations, not controlling access.
Session recording is observation, not governance
Teleport records sessions for audit. Recording captures what happened. It does not prevent what should not happen. A user running an inappropriate command is recorded doing so. The recording is evidence after the fact. It is not governance that prevents the action.
Access requests without operation-level policy
Teleport's access request workflow allows users to request elevated access with peer approval. This governs who gets access. But once access is granted, there is no operation-level policy binding. The approved access allows any operation the target permits. The approval was for access, not for specific operations under specific governance conditions.
What cryptographic governance provides
Cryptographic governance would bind signed policy to each operation, not just to access sessions. An SSH command would carry governance context specifying what commands are allowed under current conditions. A database query would be validated against cryptographically signed data governance policy. The governance would be real-time and operation-specific, not session-level and access-based.
