What was proposed
Google introduced Beyond Zero, a security model that extends zero trust into AI-agent execution. Instead of asking only whether a user can enter an application, it evaluates each action that a person or agent attempts on a specific resource using current context and risk.
Five principles
- Evaluate authorization at the resource-and-action level, not for an entire application.
- Combine verifiable static policy with dynamic controls for high-risk situations.
- Enrich decisions with the user's work, target data, requested action, and available mitigations.
- Let risk signals trigger automated in-depth investigations.
- Allow policy to require additional challenges or containment.
Google says the same approach should cover front ends, APIs, and the Model Context Protocol.
Why it matters
AI agents can use broad, previously granted permissions to act quickly across multiple systems. Reauthorizing each action with least privilege can limit the damage from prompt injection, a stolen session, or excessive tool use while preserving legitimate automation.
Limitations
Beyond Zero is currently a design framework supported by early internal prototypes. Google says industry adoption is still early and has not yet published detailed detection accuracy or operating-cost data. Fine-grained authorization can also increase policy and audit complexity, so production evidence will be important.