Google has proposed Beyond Zero, a security model that moves access decisions from whole applications to individual resources and actions. The goal is to handle autonomous agents that operate much faster than people and may perform long sequences of work after receiving initial access.
The design extends the zero-trust ideas in Google’s 2014 BeyondCorp paper. It combines fixed authorization policies with contextual risk decisions, enriches requests with information about the user, action and data, and can trigger investigation, extra verification or containment when risk signals appear. Authorization would continue throughout a workflow rather than ending after login.
Adopting that model would require software providers to expose controls at a much finer level through their interfaces and APIs. Security teams would also have to manage false positives, audit decisions and decide where probabilistic AI judgments can safely influence access. Critics note that authorization has traditionally been a deterministic security boundary, making unpredictable decisions difficult to test and review.
Google describes Beyond Zero as an ongoing effort. Its deployments are internal, some components are not yet built, and the company has not given a release timetable. For most organizations, the immediate lesson is narrower: agent systems need detailed logs, reversible actions and permissions scoped to each operation before they can safely act at machine speed.