SecurityArticle The BeyondCorp authors' successor model targets agents that inherit your permissions — and it's a decade early.
Emeka Okafor Twelve years after BeyondCorp told the industry to stop trusting the network, Google is back to tell you that zero trust itself is obsolete. In a new ACM Queue paper, "Beyond Zero: Enterprise Security for the AI Era," Google security engineers Joseph Valente and Michal Zalewski argue that the model everyone spent a decade adopting — verify identity and device, then grant access to an application — breaks down the moment autonomous agents start doing your employees' work for them. Their replacement shrinks the trust boundary from the application to the individual action, re-evaluated on every request, with AI-driven reasoning in the loop.
The instinctive reaction — and the loudest one on Hacker News — is that putting a non-deterministic model in an authorization path is malpractice. That reading misses what the architecture actually says, and the paper deserves a closer look than the reflex allows. But it also deserves skepticism on a different axis: the hard part of Beyond Zero isn't the AI. It's the data plumbing underneath it, and that's exactly where most enterprises will fail.
The problem is real: agents inherit your permissions #
The paper's sharpest observation is about what it calls ambient authority. When you wire an agent into your enterprise today, the standard move is to hand it the controlling user's credentials — an OAuth token, a service account, a delegated session. The agent now holds every permission that human accumulated over years of over-provisioning, and it exercises them at machine speed. A phished employee used to mean an attacker rummaging through files at human pace; a prompt-injected agent means the same blast radius explored in seconds.
Application-level zero trust has no answer to this, because the agent is the legitimate user as far as the proxy is concerned. Identity checks pass. Device posture passes. The malicious behavior only shows up at the level of individual actions — which files, in what sequence, at what rate — and that's precisely the layer BeyondCorp never modeled.
What Google actually built #
Beyond Zero is four components in a feedback loop. A "world model" pre-computes who accessors are (from HR systems), what data is sensitive, and what each person's work actually touches. An event-intake layer streams server logs, endpoint signals, and — new — agent telemetry: prompts, execution plans, tool invocations. A reasoning engine answers "is this specific action safe?" and returns allow, deny, or challenge. And a challenge/containment layer can demand a justification, a security-key touch, or manager approval — or revoke access outright.
The detail the HN critics skipped: the engine runs at two speeds. The at-access fast path is granular attribute-based access control — static, deterministic, latency-bounded. The AI-driven reasoning lives on the slow path, doing post-access anomaly detection that escalates into challenges and containments. Probabilistic judgment doesn't silently flip an allow to a deny; it triggers an interruption a human can answer. That's a defensible design, and it's roughly how mature fraud systems at payment companies have worked for years.
It's also less novel than the branding implies. Squint and Beyond Zero is a unification of parts the industry already has: Zanzibar-style relationship-based authorization (open-sourced descendants include OpenFGA and SpiceDB), continuous access evaluation as standardized in the OpenID Shared Signals Framework, and the behavioral analytics your SIEM vendor has been selling as UEBA. The genuinely new layer is agent intent verification — checking both that the human's prompt was appropriate and that the agent's actions match it — and that's the piece with no prior art and no metrics in the paper.
What's missing, and what to do anyway #
This is a vision paper. There are no false-positive rates, no latency numbers, and an admission that Alphabet itself is mid-transition. BeyondCorp's own papers came with years of deployment scars; Beyond Zero's are presumably still being earned. And the model's foundation — accurate HR data, semantic classification of every resource, pre-populated at low latency — describes a data-governance maturity that almost no enterprise outside a hyperscaler has. If your organization can't answer "which of our documents are sensitive" today, an AI reasoning engine on top changes nothing.
The practical takeaways for developers are more immediate than the architecture:
Stop giving agents your token. Mint scoped, short-lived credentials per task instead of delegating a user's full session. Workload identity viaSPIFFEis the closest existing standard.Make agent actions attributable now. The paper calls for request annotations tying every action to a specific agent, controlling user, and task. You don't need a standard to start stamping that into your tool-invocation logs — and you'll want it the first time an agent does something weird in production.Expect challenge friction. If this model spreads, "explain why you need this file" prompts and step-up verification will land in ordinary workflows. Agent builders should design for interruption and resumption, not straight-line execution.
The standardization asks are worth watching too: open agent-introspection APIs, an agentic identity standard, and — the long shot — SaaS vendors accepting externally operated policy decision points. That last one is where this vision most likely dies. SaaS providers have spent a decade declining to cede authorization to customer-run engines, and Google's paper offers them no new incentive beyond being asked nicely.
The verdict #
Beyond Zero is directionally right and a decade early — which is exactly what BeyondCorp was in 2014. The agent ambient-authority problem is real, application-scoped zero trust genuinely can't see it, and per-action authorization with deterministic floors and AI-assisted escalation is the correct shape of the answer. But the timeline matters: BeyondCorp took roughly ten years and an entire vendor ecosystem (the "ZTNA" market) to become something a normal company could buy. Expect the same lag here, with fine-grained-authorization vendors like OpenFGA and SpiceDB as the early beneficiaries and your HR and data-classification backlog as the real gating factor.
Don't wait for the ecosystem to arrive, though. The parts you can implement this quarter — scoped agent credentials, task-level attribution, tool-invocation logging — cost little and pay off regardless of whether Google's grander vision ships. The self-defending enterprise is a pitch; the agent with your production credentials is already in your codebase.
Sources & further reading #
[Beyond Zero: Enterprise Security for the AI Era](https://spawn-queue.acm.org/doi/10.1145/3819083)— spawn-queue.acm.org -
[Beyond Zero: Enterprise Security for the AI Era (preprint)](https://arxiv.org/abs/2605.22985)— arxiv.org -
[Going Beyond Zero: A New Paradigm for Enterprise Security](https://blog.google/security/going-beyond-zero-a-new-paradigm-for-enterprise-security/)— blog.google -
[Google's Beyond Zero: Enterprise Security for the AI Era](https://news.ycombinator.com/item?id=49081644)— news.ycombinator.com
[Emeka Okafor](https://sourcefeed.dev/u/emeka_okafor)· Security Editor
Emeka has spent over a decade tracking threat actors, vulnerability disclosures, and the evolving landscape of application security, bringing a sharp continent-spanning perspective to his reporting. He's known for translating dense CVE advisories into clear, actionable context that developers and security teams alike actually read.
Discussion 0 #
No comments yet
Be the first to weigh in.