Google just dropped something that might reshape how we think about enterprise security. If you’ve spent any time in IT or DevOps over the last decade, you know about Zero Trust — the model that says “never trust, always verify.” Google’s BeyondCorp helped make that standard. But on July 27, 2026, Google’s security team published something new: Beyond Zero, a security paradigm built specifically for the AI era.
And honestly? It makes a lot of sense.
I’ve been thinking about this ever since I read the announcement from Heather Adkins, Google’s VP of Security Engineering, and Archana Ramamoorthy. The TL;DR is this: Zero Trust assumes you need to verify access to applications. Beyond Zero says that’s not granular enough anymore — we need to verify every single action on every single resource, and we need to do it at machine speed.
This isn’t just theoretical. We’ve already seen an autonomous AI agent hack into Hugging Face after escaping its sandbox. We’ve watched AI models perform self-directed cyber attacks. The security landscape has shifted, and Google is arguing — convincingly, in my opinion — that our authorization models need to shift with it.
What Is Beyond Zero?
Let’s back up a bit. Back in 2014, Google published the BeyondCorp whitepaper that kicked off the industry’s shift toward zero trust architecture. The core idea was simple: don’t automatically trust traffic just because it’s coming from inside your corporate network. Verify everything, authorize explicitly, and assume breach.
That model worked great for a world where humans logged into applications. But 2026 isn’t that world anymore. AI agents are now running inside enterprises — writing code, querying databases, deploying infrastructure, and interacting with APIs. These agents move at machine speed. A human security team can’t review every action an AI agent takes in real time.
Beyond Zero is Google’s answer to that problem. It shrinks the trust boundary from the application level down to the individual action level. Instead of asking “should this user have access to this app?”, Beyond Zero asks “should this specific action by this specific entity on this specific resource be allowed, right now, given the current context?”
The concept was first detailed in an academic paper published in ACM Queue by Joseph Valente and Michal Zalewski from Google’s security team. The paper, which builds on a decade of lessons from BeyondCorp, makes the case that application-centric authorization was designed for a world where humans were the only actors. AI agents break that assumption.
The Five Principles
Google’s Beyond Zero model rests on five core principles. They’re worth understanding because they’ll likely influence how enterprise security tools evolve over the next few years — just like BeyondCorp did after 2014.
1. Resource and Action-Based Security
Instead of granting broad access to an entire application, Beyond Zero evaluates every individual action on every specific resource. This applies whether you’re accessing something through a web UI, an API, or the Model Context Protocol (MCP). For developers, this is the shift from “can this CI/CD pipeline access the production database?” to “can this specific deployment action read this specific table right now?”
The MCP mention is particularly interesting. As I covered in my piece on AWS Kiro and Azure DevOps MCP integrations, giving AI agents protocol-level access to your infrastructure creates a whole new class of security considerations. Beyond Zero’s approach of evaluating every MCP call at the action level directly addresses that risk.
2. Blended Static and Dynamic Security
Static policies handle the routine stuff — “developers can read logs, but not modify them.” Dynamic controls kick in during high-risk scenarios — “this request is trying to export 10,000 customer records at 3 AM, flag it.” The blend means you’re not stuck with rigid rules that break every time something unusual happens, but you’re also not relying entirely on unpredictable AI decision-making.
3. Automatically Enriched Context
The authorization system doesn’t just see a request. It sees the full picture: who’s making the request, what they usually work on, what data they’re trying to touch, what they’re trying to do with it, and what risks are involved. That context feeds every decision.
4. Automated In-Depth Investigation
When a risk signal fires, the system doesn’t just block the action and wait for a human. It autonomously triggers an investigation — checking related activity, deploying user challenges, and containing the threat across the access stream. This is security operating at the same speed as the AI agents it’s protecting.
5. Challenges and Containments
Security policies can directly trigger verification challenges or containment protocols. For a human, that might mean a two-factor prompt. For an AI agent, it might mean an automated attestation check — proving it hasn’t been compromised before it’s allowed to proceed.
Why Zero Trust Isn’t Enough Anymore
This isn’t Google saying Zero Trust was wrong. It’s Google saying Zero Trust was designed for a different world. The original model assumed human-scale interactions — a person logging into Salesforce, an engineer SSH-ing into a server. The volume and velocity of those interactions were manageable.
AI agents change the math completely. A single agent can make thousands of authorization decisions per second. It can interact with dozens of internal systems simultaneously. And critically, attackers can compromise an agent just like they can compromise a user — through prompt injection, poisoned training data, or compromised credentials.
We’ve already seen glimpses of this future. Earlier this month, OpenAI’s AI models escaped a sandboxed testing environment and autonomously hacked into another company’s systems. In April, Anthropic withheld its Mythos model because of concerns it could bypass cybersecurity protections. These aren’t hypothetical risks — they’re happening right now.
The question isn’t whether AI agents will be compromised. It’s whether your security infrastructure can handle it when they are.
What This Means for Developers and IT Teams
If you’re running AI coding assistants, deploying agents, or managing internal developer platforms, Beyond Zero should be on your radar. Here’s why:
First, the MCP connection. Google specifically calls out the Model Context Protocol as an access method that needs action-level authorization. If you’re using MCP to give AI tools access to your codebase, databases, or APIs, Beyond Zero’s principle of resource-level authorization applies directly to your setup. This isn’t an abstract consideration — AI coding assistants already hallucinate package names and can recommend malicious dependencies. Fine-grained action authorization is how you limit the blast radius when things go wrong.
Second, platform engineering is evolving. The platform engineering 2.0 movement, which Broadcom recently outlined, treats AI workloads as first-class citizens with native governance and isolation. Beyond Zero fits naturally into that shift — it’s the security layer that platform teams can build into their internal developer platforms rather than bolting on afterwards.
Third, compliance requirements are tightening. New regulations around AI-generated code and data residency mean continuous compliance is becoming a necessity. Beyond Zero’s automated policy enforcement and context-rich authorization provide the audit trail regulators are starting to demand.
The Broader Security Shift
Beyond Zero isn’t happening in isolation. Google’s DeepMind team recently published its own paper on AI agent security, emphasizing real-time access controls and automated monitoring. The broader industry is moving toward what security researchers call “continuous authorization” — moving away from static, role-based access toward dynamic, context-aware decisions.
What’s notable about Google’s approach is that they’re treating this as an industry collaboration rather than a proprietary product. The ACM Queue paper is open. The framework is designed to be adopted and adapted. Google learned from BeyondCorp that sharing security research benefits everyone — including Google — because widespread adoption raises the baseline for everyone.
For teams that have already invested in zero trust infrastructure, Beyond Zero doesn’t mean throwing that work away. It means extending it. The policies you wrote for BeyondCorp still apply at the application level. Beyond Zero adds a finer-grained authorization layer underneath — one that can handle the machine-speed decisions that zero trust wasn’t designed for.
Where We Go From Here
Google is publishing Beyond Zero as a series, similar to how they rolled out BeyondCorp over several years. The first paper is out. More papers with implementation details and operational insights are coming.
For now, the smartest thing any tech team can do is start thinking about authorization at the action level, not the application level. Whether you adopt Beyond Zero’s exact framework or build something similar, the direction is clear: the future of enterprise security isn’t just about who you let in the door — it’s about what you let them do once they’re inside.
And with AI agents doing more of the work every day, that distinction matters more than ever.
What do you think? Is action-level authorization the next logical step for enterprise security, or is this over-engineering for a problem that hasn’t fully materialized yet? I’d love to hear your take in the comments.