Google security engineers propose checking each action an AI agent takes under 'Beyond Zero'
Google security engineers have published 'Beyond Zero', a five-principle security model for AI agents, ITPro reported. Google's authors call it a new paradigm and an outside expert calls it an evolution of Zero Trust, and the gap sets how much access work carries over.
The Board Room · Leadership desk
Users are judged on single actions or specific resources, not broad app or tool grants. Risk signals trigger automatic investigations that can lead to challenges or containment. Users or agents must give extra risk telemetry on demand. Agent swarms could take more actions than a human in a day.
- constraint Users Evaluated on individual actions or specific resources, not broad authorization for a whole app or tool, claim 7
- exposure Users Can face challenges or containment once risk signals trigger an automatic investigation, claim 9
- constraint Users or agents Must provide additional risk telemetry on demand under challenges and containments, claim 10
- exposure Swarms of agents Could perform many more actions than the dozens or hundreds a human may perform in a day, claim 15
| Who | How | Kind | Claim |
|---|---|---|---|
| Users | Evaluated on individual actions or specific resources, not broad authorization for a whole app or tool | constraint | 7 |
| Users | Can face challenges or containment once risk signals trigger an automatic investigation | exposure | 9 |
| Users or agents | Must provide additional risk telemetry on demand under challenges and containments | constraint | 10 |
| Swarms of agents | Could perform many more actions than the dozens or hundreds a human may perform in a day | exposure | 15 |
What happened
- Google's security engineers, who ITPro says played an instrumental role in devising Zero Trust's original thinking, outlined the model in a new paper.
- The accompanying blog post was written by Heather Adkins, Google's VP of security engineering, and Archana Ramamoorthy, its senior director for cybersecurity and data protection.
- The first principle replaces broad authorization for a whole application or tool with evaluation of individual actions or specific resources.
- When risk signals are detected, security investigations start immediately and autonomously, and the system can deploy user challenges or containment measures.
- Under the challenge and containment principle, users or agents must supply additional risk telemetry on demand.
Why it matters
- constraint A broad grant to an application or tool no longer satisfies the model, so each agent's actions and resources have to be listed before any policy can be written.
- cost Every added check is a decision the policy system must make and a policy someone must maintain, and that load lands on identity and platform teams.
- decision Security leaders have to decide whether containing a running agent is automatic or needs a person's approval, because the investigation step is built to start without waiting.
The case in the Google post starts with attacker speed. Adkins and Ramamoorthy wrote that "AI is changing the assumptions around how enterprise security works" [3] and that "attackers can leverage similar speed to compromise privileged credentials and execute attacks" [4]. In our view the pairing explains the design: a privileged credential used at machine speed can do a great deal after a single entry check. The five principles are resource and action-based security, blended static and dynamic security, automatically enriched context, automated in-depth investigation, and challenges and containments [6].
The sources disagree on how large a break this is. Google's authors say the threats create the need for "a new security paradigm" [5]. Dean Gefen, founder and CEO of the workforce development firm NukuDo [11], describes an evolution. Zero Trust introduced the "enduring principle" that legitimate access should never be confused with unlimited trust, he said, and what is changing is the level at which trust is evaluated [12][13]. "As organizations introduce more automation and AI into their environments, determining whether an identity should enter a system is only part of the security challenge," Gefen said [14]. ITPro's own line is the bluntest: conventional Zero Trust principles "simply won't cut it" [16].
We think Gefen's reading fits the list better, because none of the five principles withdraws the idea that access is not unlimited trust. A team deciding this quarter would be sizing an extension of its access program.
The trade-off is control against decision volume. ITPro wrote that humans may perform dozens or even hundreds of actions in a day, a fraction of the number swarms of agents could perform [15]. Checking each one multiplies the decisions a policy system makes. Google's design does not apply the same scrutiny everywhere: heightened measures come in high-risk or complex scenarios, paired with granular static policies [8].
We'd expect the work to run in sequence. This quarter is the inventory of what each agent does and which resources it touches. Next quarter is the question of what automated investigation and containment do to a running agent. In the design, investigations start immediately and autonomously when risk signals appear [9].
The quoted material does not include migration costs or timelines. ITPro's account is the only source for the five principles [1].
What to watch
- Whether Google's full paper says who approves containment of a running agent and how policies for individual actions are written and maintained.
- Whether any organization other than Google's authors reports running action-level authorization for agents in production, with cost or timeline figures.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+35
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google's security engineers, who played an instrumental role in devising the original thinking behind Zero Trust, outlined a new cybersecurity paradigm they labelled 'Beyond Zero' in a fresh paper.
- [2]
Heather Adkins is Google's VP of security engineering and Archana Ramamoorthy is its senior director for cybersecurity and data protection; they wrote a blog post on the new paradigm.
- [3]
Adkins and Ramamoorthy wrote that AI is changing the assumptions around how enterprise security works: "AI is changing the assumptions around how enterprise security works."
- [4]
Adkins and Ramamoorthy wrote that "attackers can leverage similar speed to compromise privileged credentials and execute attacks."
- [5]
Adkins and Ramamoorthy wrote: "This creates the need for a new security paradigm that is capable of defending against these new threats."
- [6]
Beyond Zero is built on five principles: resource and action-based security, blended static and dynamic security, automatically enriched context, automated in-depth investigation, and challenges and containments.
- [7]
Under resource and action-based security, rather than granting authorization broadly for an entire application or tool, users are evaluated at the level of individual actions or the need to tap specific resources.
- [8]
Under blended static and dynamic security, heightened security measures are applied during high-risk or complex scenarios by pairing dynamic controls with granular static policies.
- [9]
Under automated in-depth investigation, security investigations are immediately and autonomously triggered when risk signals are detected, and the system can then deploy user challenges or containment measures.
- [10]
Under challenges and containments, verification challenges or containment protocols are triggered based on containment policies, and users or agents must provide additional risk telemetry on demand.
- [11]
Dean Gefen is the founder and CEO of cybersecurity workforce development firm NukuDo, with a background in military intelligence, cyber operations and enterprise security.
- [12]
Gefen said Zero Trust introduced the "enduring principle" that legitimate access should never be confused with unlimited trust.
- [13]
Gefen said what is evolving is the level at which trust must be evaluated, moving from trust decisions primarily around access toward granular decisions around specific actions and resources.
- [14]
Gefen said: "As organizations introduce more automation and AI into their environments, determining whether an identity should enter a system is only part of the security challenge."
- [15]
Humans may perform dozens or even hundreds of actions over the course of a day, a fraction of the number of actions that swarms of agents could perform.
- [16]
ITPro wrote that each action must be compliant with access principles and that conventional Zero Trust principles "simply won't cut it" for autonomous AI.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- itpro.comWhat is Beyond Zero? The latest Google-backed security trend explained
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.