Beyond Zero: Google Publishes Successor to BeyondCorp

Renato Losio · rss · 2026-09-05 source ↗ Reader 🖥️

practical · mixed — InfoQ news reporting on a Google research paper: expository summary of the paper's five principles, plus argumentative content carried by quoted sources (Valente/Zalewski's justification, Narraway's and Hacker News's skepticism). Ultimately practical — the underlying claim is about how enterprises should architect access control, not merely what is true about it.

Structure

Key terms

• Beyond Zero
  Google's successor to BeyondCorp: a 'security model for the AI era' that authorizes individual actions on individual resources continuously, using contextual and risk-based controls, for both human and AI-agent accessors.
• BeyondCorp
  Google's 2014 zero-trust whitepaper/model that replaced network-perimeter security with identity- and context-based verification of human users accessing applications — now framed as the predecessor whose assumptions have expired.
• resource-level / action-level authorization (vs. application-level authorization)
  Authorization evaluated per individual action on a specific resource or API call, rather than per session-level grant of access to an entire application.
• continuous authorization
  Access decisions re-evaluated for every action in real time rather than granted once at login or session start and then trusted for the session's duration.
• machine-speed enforcement
  Authorization decisions and enforcement mechanisms that operate fast enough to keep pace with AI agents acting far faster, and in far greater volume, than human users.
• non-deterministic access control
  As used by Hacker News commenter 'stogot': authorization decisions made by an AI model, whose outputs are not guaranteed to be identical given identical inputs, as opposed to a fixed, deterministic policy engine.

Propositions

• explicitBeyond Zero extends Zero Trust principles from human users to autonomous AI agents, treating both as first-class subjects of continuous authorization.conf: high
  extendsAnthropic Details How It Contains Claude Across Web, Code, and Cowork · p1 — Beyond Zero's continuous, resource-level authorization is precisely the kind of hard 'environmental control' this earlier proposition argues is the only thing that can set a real boundary on agent behavior, as opposed to model-level controls.
• explicitBeyond Zero moves the unit of authorization from the application as a whole down to individual resources and actions.conf: high
  supportsAnthropic Details How It Contains Claude Across Web, Code, and Cowork · p10 — Both argue authorization must be scoped at the resource/action level rather than a coarser boundary (application, or allowlisted domain), because the coarser boundary silently grants everything reachable through it.
  extendsHow to Manage Privilege Drift in Multi-Agent Systems · p5 — Beyond Zero generalizes 'enforce least privilege at runtime, at the point of tool invocation' into a full architecture: continuous, action- and resource-level authorization for every access, human or agent.
• explicitBeyond Zero combines static authorization policies with dynamic, AI-driven decisions — reserving the dynamic layer for higher-risk scenarios — to achieve machine-speed enforcement.conf: high
  supportsHow to Manage Privilege Drift in Multi-Agent Systems · p7 — Beyond Zero's principle of automated investigation triggered by risk signals is the same continuous-monitoring argument — catching drift or anomalies that static, point-in-time reviews miss — applied at Google's operational scale.
• explicitBeyondCorp's founding assumptions — that accessors are human, that actions occur at human speed, and that applications are the correct trust boundary — are no longer sufficient in an AI-agent era.conf: high
• explicitFor Beyond Zero to be adoptable beyond Google, SaaS vendors must expose action-level authorization interfaces and industry standards for such authorization must mature.conf: high
• implicitSmaller security teams face disproportionate difficulty implementing Beyond Zero-style controls — around false positives, determining intent, auditing, and cost — relative to a resource-rich organization like Google.conf: high
• explicitBeyond Zero is currently aspirational: Google's own deployments are internal-only, its components are not all built, and further explanatory papers are still to come.conf: high
• implicitGoogle is repeating its 2014 BeyondCorp playbook — publish a high-level architectural vision and invite the industry to build toward it collaboratively — rather than shipping a ready-to-adopt product.conf: high
• explicitSome practitioners argue that non-deterministic, AI-driven access decisions are fundamentally unsuited to security's need for deterministic, verifiable controls.conf: high
• implicitIntroducing AI into authorization decisions trades some of the predictability and auditability of a traditional hard security boundary for the ability to adapt to machine-scale, unanticipated agent behavior.conf: medium
• explicitExpanding auditability and reversibility in software is a necessary preparation for the arrival of AI agents.conf: high
• implicitThe impetus for Beyond Zero was primarily quantitative: Google's internal continuous-authorization approach, initially judged overkill, became necessary only once the accessor population scaled from thousands of human workers to hundreds of thousands, and then to millions of agents.conf: high

Arguments

Narratives

• Valente's LinkedIn account of Google's internal system scaling from thousands of human workers, to hundreds of thousands, to being 'joined by millions of agents' — with continuous per-action authorization going from 'seemed like overkill' to necessary.
  → Implicitly supports the proposition that Beyond Zero emerged from organic operational necessity driven by scale, not from speculative up-front design — lending the architecture empirical credibility that a pure thought-experiment would lack.
• The lineage from the 2014 BeyondCorp whitepaper to the 2026 Beyond Zero paper, explicitly cast by the author and by Narraway as 'the same playbook.'
  → Functions as a narrative of institutional continuity that implicitly argues for taking the new model seriously (Google shipped the previous vision and the industry did eventually adopt it) while simultaneously supporting the skeptical reading (it also means years will pass before this is broadly usable).

Questions addressed

• ✅ How should enterprise access control adapt now that AI agents, not just humans, are requesting access to resources?
  Resolved at the level of a proposed architecture (five principles centered on resource/action-level, continuously authorized, context-aware control) — not yet resolved as a demonstrated, adoptable practice outside Google.
• ⭕ Are AI-driven, non-deterministic authorization decisions compatible with security's traditional need for auditability and predictability?
  Raised explicitly by Hacker News commenters and implicitly by the auditability/reversibility point, but the article reports the objection without adjudicating it or examining Beyond Zero's actual static/dynamic split in response.
• ⭕ What has to change — standards, vendor APIs — for organizations beyond Google to adopt fine-grained, resource-level authorization?
  Partially named (SaaS vendors must expose action-level authorization; standards must mature) but not detailed — left as an acknowledged open problem rather than a solved one.

Gaps

• incompleteThe article never explains the internal mechanics of the 'dynamic AI-driven decisions' component — what kind of model performs the risk evaluation, what its false-positive/false-negative rate is, or how it would interact with existing IAM/policy-as-code engines (OPA, Cedar) already used for agent governance elsewhere in the corpus.
  Read next: Google's forthcoming implementation papers, and a direct comparison against policy-as-code frameworks (OPA/Cedar) already covered in the corpus's agent-governance material (e.g. the AWS Loom and privilege-drift extractions).
• incompleteNo adoption data or case study exists yet: Google states deployments are internal-only, and the 'community reaction' section is limited to a single Hacker News thread days after publication — there's no account of what a non-Google organization with materially fewer resources would actually need to build to get even a partial version working.
  Read next: Track follow-up InfoQ or industry coverage as Google publishes the promised additional papers, and read Kane Narraway's own 'Beyond Zero: For The Rest Of Us' post directly for a practitioner-scale adaptation.
• uninformedThe article doesn't engage at all with how Beyond Zero's continuous, per-action authorization model would interact with, replace, or duplicate the just-in-time token issuance and platform-wide permission-inventory approaches already covered elsewhere in the corpus's privilege-drift and agent-governance material, even though both are solving the overlapping problem of bounding what an agent can do at any given moment.
  Read next: Read the privilege-drift-in-multi-agent-systems and AWS Loom governance extractions side by side with Beyond Zero's five principles to map where the mechanisms converge or diverge.
• illogicalThe Hacker News syllogism ('Zero trust is deterministic. AI is non-deterministic. Non-deterministic access controls are a terrible idea.') is reported but never examined against Beyond Zero's actual hybrid design — static policies handle baseline enforcement, and AI-driven decisions are reserved for higher-risk scenarios per the paper's second principle — so the article lets an objection to a stronger, purer 'AI decides everything' claim stand unchallenged even though it may not be the claim Google is making.
  Read next: A close technical reading of the original ACM paper to establish exactly which authorization decisions are delegated to the AI-driven layer versus kept as static, deterministic policy.

Closes gaps elsewhere

• How to Manage Privilege Drift in Multi-Agent Systems · g3 — Beyond Zero explicitly targets 'machine-speed enforcement' — a hybrid of fast static baseline policy plus AI-driven dynamic decisions reserved for higher-risk scenarios — which is a direct (if aspirational, per practitioner skepticism) answer to whether continuous per-action authorization reintroduces a synchronous latency checkpoint into otherwise-autonomous agent workflows.

Related documents

• 5 Signs That Authenticated API Traffic Is Actually Malicious
  Agent Governance (Internal) Agent Security Privilege Drift / Scope Sprawl
• The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.
  Agent Governance (Internal) Agent Security Sandboxing
• An Evolutionary Architecture Pattern for Managing AI's Pace of Change
  Agent Governance (Internal) Agent Security Policy-as-Code
• GitLab Warns That AI Agent Sandboxes Are Only as Secure as Their Network Access
  Agent Governance (Internal) Agent Security Sandboxing
• GKE Security Blueprint Joins Growing List of Cloud AI Frameworks
  Agent Governance (Internal) Agent Security Sandboxing
• Governing AI in the Cloud: A Practical Guide for Architects
  Agent Governance (Internal) Agent Security Policy-as-Code
• How to Manage Privilege Drift in Multi-Agent Systems
  Agent Governance (Internal) Agent Security Privilege Drift / Scope Sprawl
• Prompt Injection to Data Exfil in 3 Hops
  Agent Governance (Internal) Agent Security Policy-as-Code
• Presentation: The Agent Harness: Control Planes, Invariants, and Approval Boundaries for Production AI Agents
  Agent Governance (Internal) Agent Security Sandboxing
• A big week for AI denialism
  Agent Security Sandboxing