Google Introduces Beyond Zero Security Model for AI Agents, Successor to BeyondCorp

Beyond Zero: A New Security Model for the AI Era

Google introduced Beyond Zero, a new security model designed for the AI era, detailed in a recent research paper. This model extends the principles of Zero Trust to include autonomous AI agents, shifting access decisions from the application level to individual resources and actions. It integrates static authorization controls with dynamic, AI-driven decisions to facilitate machine-speed enforcement for both human users and AI agents.

Core Principles of Beyond Zero

Beyond Zero operates on five key principles: authorization at the level of individual actions and resources across interfaces and APIs; a combination of static policies and dynamic controls for higher-risk scenarios; automatically enriched context regarding users, actions, data, and risks; automated investigation triggered by risk signals; and challenges or containment measures requiring additional verification or telemetry from users and AI agents. This framework enables continuous authorization of individual actions based on context and risk.

Evolving from BeyondCorp

The new model addresses the limitations of Google's 2014 BeyondCorp whitepaper, which established a zero-trust model for enterprise access by replacing network-perimeter security. Joseph Valente and Michal Zalewski, authors of the paper, state that BeyondCorp's assumptions—that accessors are human, actions occur at human speed, and applications define trust boundaries—are no longer sufficient in the current enterprise landscape. The rise of AI and millions of agents necessitates a more granular and dynamic approach to security.

Industry Implications and Challenges

Adopting Beyond Zero will require SaaS vendors to expose action-level authorization, and security standards will need to mature. Smaller security teams may face challenges related to false positives, intent, auditing, and cost. Google's internal development of continuous authorization for every action at scale, initially seeming like overkill, became necessary as the number of workers and agents grew significantly.

Adapting to the AI Enterprise Landscape

Heather Adkins and Archana Ramamoorthy of Google describe Beyond Zero as a 'new paradigm for enterprise security.' They explain that the enterprise landscape is entering an AI era, where artificial intelligence is fundamentally changing the assumptions about how enterprise security functions. Beyond Zero represents Google's response to these evolving security requirements.