Jot Google recently released a research article on Beyond Zero: Enterprise security for the AI era.
If the name Beyond Zero sounds familiar, it's because this is a mix of Zero Trust and [Beyond Corp](https://en.wikipedia.org/wiki/BeyondCorp?ref=cephalosec.com), Google's own spin of Zero Trust Architecture (ZTA). Announced in a [paper back in 2014](https://research.google/pubs/beyondcorp-a-new-approach-to-enterprise-security/?ref=cephalosec.com) it is now also their ZTA [commercial offering](https://cloud.google.com/beyondcorp?ref=cephalosec.com) in the same vein of Cloudflare Zero, Zscaler Private Access, Microsoft Global Secure Access, etc.
While those products are commonplace in 2026, BeyondCorp felt visionary 12 years ago, surely one of the first ZTA implementation at this scale. I'm having the same feeling with Beyond Zero: how on earth can you apply such principles with today's capabilities.
Most ZTA solutions heavily focus on Identity and Device metrics to take a decision; sometimes with extra contextual information like location, or risk-based trigger like use VPN, abnormal working hours etc. Beyond Zero adds real-time activity monitoring and intent inference to the mix. Yes, you read right, “intent”:
Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime. [...]
User Intent + Agent Intent can be an input in dynamic evaluation against Policy Intent. [...]
Looking at an action in the context of the many operations that a user or agent has performed both before and after their action can give a more holistic picture of whether the action is legitimate. [...]
The vast majority of this information is not directly acted upon by the agent but is used to gradually build a better understanding of user behavior and to intercept actions once a certain risk threshold is exceeded
This drastic hardening of access control is deemed necessary by its author because of the surge of agentic workflows which totally changed the frequency, volume, and variety of data being accessed:
Autonomous AI agents and the accelerating velocity of corporate data access are stretching the application-centric model of zero trust security to its breaking point. [...] Now that we are entering an era where AI agents access data at 10 times the rate of humans, often reasoning about information across vast unstructured dataset, a new model is needed for securing data. [...] It is not merely the frequency of access that has changed, but also the volume of data being consumed. [...] This combination of machine-speed attacks and nondeterministic agent behavior creates a risk profile that requires a move toward dynamic, intent-based defense.
This is achieved, you probably guessed it by now, by leveraging an AI model as part of their “reasoning engine”. The reasoning engine is most likely built on top of BeyondCorp's Trust Inferer, which was used by their Access Control Engine. Using NIST's ZTA lingo, this would be the Policy Decision Point.
The reasoning engine is the heart of Beyond Zero. It is a hierarchical AI system distributed across central server-side components and endpoint agents that consumes information about accessors as well as recent access signals to answer a single question: In the context of what is known about the user and the resource, is this specific action safe?
This is flabbergasting on multiple aspects.
First is its speed, as while the tool can be leveraged for automated investigation totally decoupled from the access control, they can also happen in real-time:
In faster configurations, the reasoning engine can perform granular attribute-based access control to determine, for example, if a person is accessing data belonging to a VIP user in one of the customer support tools or if a person is attempting a high-risk operation. These can be blocked at access time
Second, the amount of contextual data they manage to ingest, centralise and organise for the reasoning engine to retrieve and leverage in real-time for such decisions, especially the “how”:
The decision systems can draw on context about the user, what the user should be working on, what data the user is trying to interact with, what the user is attempting to do with the data, and what potential risk mitigations are available.
Through integration with existing HR and project management warehouses and other sources of data that show who humans inside the company are and how their work relates to the company’s assets, the autonomous governance component uses AI to generate and maintain a live enterprise world model [...]
Who—information about accessors (humans and agents), including their job function, role, seniority, controlling human (in the case of agents) [...]
What—a semantic understanding of data sensitivity (confidentiality [e.g., confidential, public, crown jewels, etc.] and data type [e.g., user data] [...]
How—information about what accessors are tasked to work on and how they do their work, based on historical usage and sharing patterns, group membership, team membership, assignments [...]Preprocessing extracts the precise data around work assignments (for example, a user is currently working on an assignment that requires access to data belonging to customers A, B, and C only).
Third, that those decisions allow to dynamically challenge or even block individual actions within the target system. Most ZTA system only act at the authentication step, then lose all visibility in what is being done by the user with the granted access. At best, they dynamically cut network line of sight if some contextual information in their visibility changes, such as device compliance. Beyond Zero is much more granular:
Beyond Zero architecture performs per-resource access decisions for humans and agents at machine speeed. Byshrinking the trust boundary from the application level to individual action and by coupling static authorization guarantees with dynamic, AI-driven reasoning. [...]
Individual actions on individual resources are where authorization decisions are made, rather than provisioning access to a tool, application, or feature within an application. [...]
Policies are dynamically derived from reasoning decisions and immutable principles that govern access. When an action is performed on data, a set ofchecks is performed, taking into account various pieces of information about the accessor, the data being accessed, and the operation being performed to authorize the access
We maintain static policies (the floor) to ensure baseline security and compliance.Layered on top is a dynamic reasoning engine (the ceiling) that observes behavior and applies friction (challenges) when an action deviates from established norms or carries high risk.
One thing to keep in mind, these dynamic, AI-based checks are done in addition to static policies enforced by BeyondCorp, not in replacement:
Granular static policies are applied to resource accesses in addition to fully dynamic controls that apply even stronger security in risky or complex scenarios.This allows for dynamic controls to be applied without shifting to a fully dynamic security model that is challenging to statically verify
It's reasonable to assume those dynamic checks can only further restrict access and not authorise what would have been blocked by the static policies, thus reducing the risks tied to AI manipulation and hallucinations.
Speaking of those dynamic controls, they manifest as extra “friction” and can take two forms: Challenges and Containments:
Challenge infrastructure is used to either gather context using challenges or restrict access using containments.Challenges are introduced to gather further context before deciding whether to grant access. Containments are more durable “stop signs” that are designed to introduce substantial friction to an accessor’s access in order to stop attacks. Containments are designed to be dynamic and to move up or down in strength should a completed challenge clarify that the detected risk was a false positive.
Challenges are sanity checks to confirm the legitimate user is still behind the steering wheel and the ongoing action is legitimate:
When the reasoning engine detects ambiguity or elevated risk, it triggers a challenge. Unlike the blunt “access denied” of the past,challenges are granular and context-aware:
Justification. “Please explain why you need access to this file.”
Verification. “Touch your security key to prove you are present.”
Approval. “Requesting manager approval for bulk export.”
Biometric. “Please perform a selfie check to prove you’re sitting at your machine.” [...]
More dynamic checks are also possible. For example, a person attempting to email data to their personal account might beasked to provide a justification that can be checked against the document contents in realtime
Containments go further and can temporarily reduce access until the situation is clarified, for example via an investigation:
These interruptions revoke some or all of the actor’s access in response to a perceived risk. Containment revocation is generally not as straightforward as challenge completion. While some containments can be revoked by correctly passing a challenge, other containments might be lifted only when the security team interviews the contained user and their manager before deciding on a course of action
Let's conclude with some examples of how Beyond Zero can intervene in an attacker scenario:
An external party attempts to compromise an enterprise by purchasing the stolen credentials of one of their contractors who is working on software development.As soon as the external attacker attempts to use the credentials to start their attack, they are seen trying to access data not linked to the contractor’s scope of work, and various challenges can be issued to the accessor to confirm the access is legitimate.[...] At access time, the reasoning engine sees that a high-risk accessor with low subject-matter crossover is attempting to access sensitive documents. The contractor is given the option of requesting access via a document owner approval challenge.
Consider a scenario where an internal AI agent, SalesGenie, is authorized to read sales reports. SalesGenie attempts to query a highly sensitive strategic planning document inside Google Drive. [...] The reasoning engine sees that the user that prompted SalesGenie works only on financial services accounts in the Northeast.The user’s risk score is also higher, as they have been recently attempting accesses that are not closely related to their work assignment. The data being accessed is highly strategic, company-level data used only in financial reporting. The only teams that typically access this data are the strategy and finance teams. The data is classified as highly confidential, the highest tier of sensitivity, as it could be used in insider trading. [...]Following the failure to clear challenges and a more detailed inference completing over a larger set of actions, the user is then contained.In the vast majority of cases,the decision to contain will be autonomous. Only a tiny percentage would be escalated to human review when there is a high confidence in malicious intent, which is substantially higher fidelity than the current paradigm
Similar to BeyondCorp back in 2014, Beyond Zero feels out of reach for most companies. Having a centralised, granular, CRUD visibility of each object processed in the various corporate apps and database looks daunting. Google is known for building most of their tooling internally, which certainly helps for such requirements. This is not the case for the average company that usually leverages off-the-shelf, commercial SaaS solutions.
This is acknowledged in their paper as they are asking for a broader alignment across the industry to reliably build those capabilities:
Open architectures that can enhance transparency into access as enterprises make the agentic transformation—for example, standardized APIs for agent introspection, with a standardized way to analyze chain-of-thought/tool use in realtime.
Standards for agentic identities and how to define and control their access—for example,an industry standard for request annotations to make all agent actions attributable to a specific agent, a specific controlling user, and a specific task
Frameworks for allowing reasoning engines to safely make access decisions and take actions—for example,make external, enterprise-operated policy evaluation and decision-point integration and enforcement a first-class citizen for all software-as-a-service products.
I recommend you read the paper in full, it's truly inspiring.