Google's Beyond Zero extends zero-trust security to AI agents

Google has unveiled Beyond Zero, a security framework that reimagines enterprise access control for an era dominated by autonomous AI agents. The approach, detailed in a recent research paper and blog post, represents a fundamental shift from its influential 2014 BeyondCorp zero-trust model by moving authorization decisions from applications to individual resources and actions.

The shift from BeyondCorp to Beyond Zero#

The original BeyondCorp framework replaced network-perimeter defenses with granular access controls, but it assumed humans would perform actions at human speed. Beyond Zero reconsiders these foundations for a world where AI systems execute thousands of operations per second. As the researchers note, "The assumptions underpinning BeyondCorp — that accessors are human, that actions occur at human speed, and that applications are the correct boundary for trust—are no longer sufficient."

How Beyond Zero works#

The new model combines static authorization policies with dynamic, risk-based controls that operate at machine speed. It operates on five core principles:

• Granular authorization at the level of individual actions and resources rather than entire applications
• Layered decision-making that blends predetermined rules with adaptive AI-driven logic for high-risk scenarios
• Real-time enrichment of context data about users, actions, data, and detected risks
• Automated investigation workflows triggered by risk signals
• Adaptive verification measures that can demand additional confirmation or telemetry from users and agents

This approach enables continuous authorization checks without requiring human approval for every single machine operation.

Industry reaction and implementation challenges#

Google states that Beyond Zero remains an internal deployment and that key components are still under development. Kane Narraway, a security leader at Canva, acknowledges the framework's vision but cautions that most enterprises will struggle to implement it quickly, noting this is the same "publish the vision, describe the architecture, encourage industry collaboration" playbook Google used with BeyondCorp.