Beyond Zero: BeyondCorp's Successor for AI-Agent Security

Key takeaways

1. Date / source. July 20, 2026, ACM Queue vol. 24 no. 3, CC BY 4.0, authored by Joseph Valente (Alphabet Security) and Michal Zalewski. A single bibliographic reference: the 2014 BeyondCorp whitepaper.
2. Key framing. the application boundary is reaching end of life. Classic zero trust shifted trust from the network to identity and device, but kept the application as the unit of authorization — too coarse a unit once the accessor can reason over an entire corpus in seconds. The new proposed unit is the individual action on the individual resource, regardless of the access path (front-end, API, MCP). ### The three BeyondCorp assumptions the article abandons 1. Accessors are human. 2. Actions occur at human speed. 3. The application is the right trust boundary. Each falls for a different reason: this is not a patch, it is a model change. ### The four components, in loop order | # | Component | Content | |---|-----------|---------| | 1 | Autonomous governance | uses AI to build a living enterprise world model — Who (function, role, seniority, controlling human for an agent), What (semantic understanding of data sensitivity), How (assignments, usage and sharing patterns). Fed by HR and project-management data warehouses. Explicit analogy with a self-driving car's world model | | 2 | Event intake | server signals (proxies, APIs, productivity apps), client signals (browser state, local file access, process activity, DLP), and agent activity (prompts, execution plans, tool invocations). Hot cache for access-time evaluation, long-term store for slow inference | | 3 | Reasoning engine | hierarchical AI, distributed across server/endpoints. Fast: granular ABAC, blocks at access time. Slow: complex anomalies (a user accessing 500% more files than their peer group). Allow / deny / challenge verdict, and decisions themselves become attributes reused downstream | | 4 | Challenge infrastructure | reversible challenges (justification, security key tap, manager approval, selfie) vs. durable containments, sometimes lifted only after the employee and their manager are interviewed | ### The design move: floor / ceiling Static policies = the floor (security and compliance baseline, statically verifiable); dynamic reasoning engine = the ceiling. Explicit justification: this allows for dynamic behavior "without shifting to a fully dynamic, hard-to-statically-verify model." The entire security decision is not handed to the model. Same architectural figure as the constraint ring in [[sfeir-code-review-anneau-contraintes-2026-07-30]]. ### The named attack vector "The exploitation of ambient authority, where an agent is granted the full, often overprovisioned permissions of its human user." This is the mechanism by which a prompt injection becomes an exfiltration: the agent does not need to escalate privileges, it already has too many. The proposed countermeasure is not a filter on the prompt but an intent-consistency check — "User Intent + Agent Intent can be interpreted and checked to ensure alignment," and "The human actor must confirm that the access the agent is attempting is intended by the human." ### The SalesGenie example, usable as-is An internal agent authorized to read sales reports queries a strategic planning document. | Model | Verdict | Reason | |---|---|---| | BeyondCorp | ALLOW | valid certificate, authorized machine, both identities can read sales reports | | Beyond Zero | CHALLENGE then CONTAIN | the human who issued the prompt only works on Northeast accounts, the data is top-tier (insider-trading risk), policy requires a valid work assignment | Three-stage intervention: intent confirmation by the human, approval request to the owning team, containment. "In the vast majority of cases, the decision to contain will be autonomous." ### The architecture's real bet "Inference tasks must be front-loaded": access-time latency budgets rule out on-the-fly reasoning, so almost everything must be precomputed. The quality of access control then becomes exactly equal to the quality of the HR and project-management data. The "work assignment" attribute that decides access in the SalesGenie example presupposes a level of data hygiene few organizations reach. The first point to raise in any transposition workshop. ### Reservations
3. Vision paper, not a war story. no production metrics, no false-positive rate, no deployment scale, no latency figures — whereas [[uber-engineering-agent-identity-crisis-zero-trust-spire-2026-05-21]] had published a P99 < 40 ms and thousands of agents in production two months earlier.
4. Internal order-of-magnitude inconsistency. the problem statement speaks of "tens of millions of concurrent machine-driven actions per second," while the abstract and conclusion speak of "thousands of decisions per second" — a four-order-of-magnitude gap. Do not cite both figures without flagging it.
5. Unsourced figures. "AI agents access data at 10 times the rate of humans," a central claim, unsourced.
6. False-positive cost not quantified. the article claims that only "a tiny percentage" of containments would escalate to human review, without data. Yet containing an innocent employee costs a security interview with their manager; at scale, that rate is what decides whether the model is deployable.
7. The circularity is not examined. the system defending against AI-driven attacks is itself an AI reasoning engine. No mention of attacks against the reasoning engine — poisoning of the HR data feeding the world model, injection into semantically analyzed documents, slow manipulation of its own behavioral baseline. ### The European blind spot The described system is also an employee-surveillance apparatus: a selfie to prove one is at their machine, client-side signals, behavioral baselining against the peer group, and derivation from HR data of what the employee should be doing. Not a word on GDPR, proportionality, informing employee representative bodies, or the fact that a containment revoked after interviewing the employee and their manager carries labor-law implications. This is the first transposition obstacle, and it is absent from the text. ### The call to the industry, useful as a reading grid for upcoming offerings 1. Open architectures — standardized APIs for agent introspection, a standard means of analyzing chain-of-thought and tool usage in real time. 2. Agentic identity standards — annotations making every action attributable to an agent + a controlling user + a task. 3. Externalized decision frameworks — making a policy-evaluation point operated by the customer organization a first-class citizen of every SaaS product. The politically heaviest ask: it requires vendors to accept that a third party decides access within their own product. NIST has launched an effort on agent security. ### Positioning read BeyondCorp (2014) was not a product but a publication that created a category — ZTNA/SASE, which became a market within a decade. Beyond Zero replays the same move: publish early, under CC BY, in a practitioner journal, with a call for standardization. Read it as a market-structuring document as much as an architecture. Published the day before Anthropic's write-up on its secure SDLC — [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]: Anthropic secures code production by agents, Google secures agents' access to data. Disambiguation: this article's enterprise world model (a living representation of the organization serving authorization) has no relation to Google DeepMind's generative world models, even though both come from Google. Same phrase, distinct objects — do not merge them in the graph.