From zero trust to continuous authorisation

Google has introduced Beyond Zero, a proposed enterprise-security paradigm intended for organisations where employees and AI agents increasingly access data, software tools and operational systems at high speed. Announced on 27 July 2026, the framework extends the logic of zero trust from deciding whether an identity may enter an application to deciding whether a specific action on a specific resource should be permitted.

The distinction matters because generative AI agents do not merely retrieve information. They can use APIs, invoke tools, read and modify enterprise records, and carry out multi-step workflows. Those capabilities can improve productivity, but they also turn a successful credential theft, flawed instruction or prompt-injection attack into a potentially fast-moving operational event. Google’s argument is that application-level permissions are too broad for this setting: an agent granted access to a business system may have many more possible actions available than its immediate task requires.

Beyond Zero is a framework rather than a generally available Google security product. Google says that it is based on early internal prototypes and deployments, and that it will release further technical papers and operational details over time. That positioning is important. The announcement outlines an architectural direction and reports internal observations, but does not yet provide independently assessed performance results, a reference implementation or a formal industry standard.

The inheritance from BeyondCorp

The name deliberately follows Google’s BeyondCorp work, published in 2014. BeyondCorp was an influential expression of what later became widely known as zero trust: a model that removes implicit confidence in a corporate network and instead evaluates user identity, device condition and other signals before access to an enterprise resource is granted.

Zero trust already shifted security away from the old assumption that a device on an internal network should be trusted. NIST’s zero-trust guidance similarly frames protection around users, assets and resources rather than a fixed network perimeter. It also recognises that continuous assessment and narrow access rights are central to limiting breaches and lateral movement.

Beyond Zero advances that scope further. Rather than treating an application as the practical trust boundary, Google proposes making individual resource-and-action combinations the unit of authorisation. In practical terms, a user or agent might be allowed to view a customer record but not export it; draft a payment request but not submit it; or query an internal system without being permitted to change configuration. The proposed policy should apply consistently whether the action originates in a graphical interface, an API or a Model Context Protocol connection.

This is a meaningful evolution of least privilege. Conventional role-based access controls remain useful for assigning broad responsibilities, but they can struggle when an agent takes numerous tool calls on a person’s behalf, with each call carrying different sensitivity and business consequences. Per-action control promises a more precise decision point.

Five principles behind the model

Google identifies five connected principles. The first is resource-and-action-based security: every request is evaluated at the level of the target resource and requested method, rather than by a broad grant to a tool or application.

Second, Beyond Zero combines static policies with dynamic controls. Static rules offer predictability, reviewability and a way to demonstrate that prohibited behaviour is not allowed. Dynamic controls use live risk information to impose extra protection where circumstances warrant it. The hybrid approach reflects a practical tension in security architecture: policies that are entirely dynamic may adapt quickly, but they can be difficult to inspect and prove correct before an incident.

Third, the framework calls for automatically enriched context. A decision engine should have usable information about the identity involved, the task it is expected to perform, the data being reached, the contemplated operation and available mitigations. This implies a considerable data-engineering requirement. Identity directories, asset inventories, data classification, workflow definitions, device posture and security telemetry need to be sufficiently accurate and available at decision time.

The final two principles concern response. Risk signals may trigger automated investigation, while controls can issue challenges or apply containment. A human might be asked for additional verification before a sensitive export. An agent may instead be restricted, paused or required to supply stronger runtime evidence. These measures are designed to reduce the interval between a suspicious event and an access-control response.

Why agents intensify an existing access problem

The security challenge is not simply that AI agents are another type of user. Agents can interpret untrusted content, plan multiple steps and operate through systems that were designed for direct human use. A malicious instruction embedded in a document or web page, for example, could influence an agent that has been given access to enterprise tools. Industry guidance on agentic-application risk highlights threats such as goal hijacking, insecure tool use, excessive agency and weak identity or privilege management.

Google’s proposal addresses a part of that problem: the authorisation layer. It seeks to constrain what an agent can do even if its request arrives through an approved channel. This can limit the damage from over-privileged access and provide opportunities to interrupt unexpected sequences of actions.

However, granular authorisation is not a complete defence against agent failures. Enterprises will still need to secure model inputs, validate tool definitions, isolate sensitive environments, monitor data flows and design human approval for high-impact actions. Fine-grained permissions can make an agent safer to deploy, but they cannot establish that an agent’s reasoning or interpretation is correct.

The difficult implementation questions

The central operational question is whether an organisation can make these decisions at the required scale without adding unacceptable latency or breaking legitimate work. Google describes Beyond Zero as operating at machine speed, but the quality of a decision will depend on the quality and freshness of the context supplied to it. Incorrect data classification, stale employment records or poorly defined business tasks could produce inappropriate denials or, more seriously, inappropriate approvals.

Policy management is another challenge. Moving from application permissions to many action-specific policies can greatly increase the number of rules an enterprise must create, test and maintain. The static component of Beyond Zero may help organisations audit their baseline controls, while dynamic reasoning can focus attention on exceptions. Yet governance teams will need clear accountability for who defines permitted actions, how policies are simulated before release, and when automated containment can affect business operations.

Interoperability will also determine the framework’s wider influence. AI agents increasingly rely on APIs and emerging connection patterns such as the Model Context Protocol. A security model that can cover front ends, service calls and agent tool use under a consistent policy language would be valuable. But it will need support across identity providers, data platforms, workflow tools and application developers, not only within Google’s own environment.

A significant direction, not a finished standard

Beyond Zero is best read as Google’s attempt to define the next trust boundary for enterprise systems: not the network, device or application, but the individual operation on a particular resource. The idea is aligned with the direction of zero-trust and cloud-native access-control work, while addressing the speed and autonomy introduced by AI agents.

Its immediate significance is conceptual. Google is putting continuous, context-aware authorisation at the centre of AI-era enterprise security and committing to publish more of its design. The eventual test will be practical adoption: whether the approach can yield decisions that are fast, explainable and reliable enough for complex organisations, while maintaining the usability that makes secure controls sustainable.

Sources