Google's Beyond Zero: Enterprise Security for the AI Era

Attribute-based access control is already a thing. User X logs in the US East between the hours of 6am and 6pm. If User X logs in from Russia at 3am, deny access. This seems like an evolution of that pattern

To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access.

Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".

zero trust helped a lot because it forced vendors to stop relying on people magically doing the right thing ina centralized system. it decentralized boundaries.

this paper just says you still need deterministic boundaries and access control, not just have an llm say safe or unsafe. cool thanks google haha.

ps: hi guys, i know yall reading. sometimes its not the concept, its the implementation. else active shield or whatever would have worked too. not everyone can be the T7-9 thinker if implementing is seen as "for peasants"

While I think that makes sense, I also think more controls are a good solution. That is, prevent access to the sales data without escalation, probably to a human, but possibly to another AI. The issue there is twofold:

- if you start with least privilege, the agents become less useful

- need to balance escalation with frequency otherwise it's just another version of MFA fatigue

Agree that auditability is important because otherwise you don't know what you don't know.

It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.

Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.

What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?

Will exceptions be made by humans? In which case we go back to human-managed permissions.

Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour

Deterministic executes fast and you know what it will do. You want to evolve your ground truth, not hope for the best.

That said, there is a role for probabilistic elements in the security model...as bait and signal.

I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.

The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.

There is a massive difference between Google for enterprise customers and Google for consumers.

The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business.

The Enterprise offering guarantees you contractually that they never touch your data.

Now, Cloudflare, on the other hand, would be much more likely to offer a service like this.