Technical Summary: Beyond Zero: Enterprise Security for the AI Era

1. Problem Statement

The paper identifies a critical failure point in current enterprise security models, specifically the "Application-Centric" Zero Trust model (exemplified by Google's 2014 BeyondCorp). This legacy model is reaching its breaking point due to three converging shifts in the enterprise environment:

• Exponential Access Volume: The transition from a human-centric workforce to an agentic one has fundamentally altered access frequencies. AI agents (autonomous or "copilot" modes) interact with corporate resources at rates orders of magnitude higher than humans, straining legacy infrastructure designed to authorize tens of millions of concurrent machine-driven actions per second.
• Unprecedented Data Velocity and Scale: Beyond frequency, the volume and sensitivity of data being consumed have exploded. Agentic workflows involve reasoning across vast, unstructured datasets, creating a "geometric shock" where sensitive intellectual property is accessed and acted upon faster than manual oversight or post-factum security operations (SecOps) can review.
• Sophisticated Threat Landscape: Attackers now weaponize AI to rewrite malicious code on demand, rendering static detection less effective. Furthermore, agentic infrastructure introduces new vectors, such as the exploitation of "ambient authority," where agents inherit the often over-provisioned permissions of their human users. The combination of machine-speed attacks and non-deterministic agent behavior necessitates a shift from static, application-boundary defenses to dynamic, intent-based defenses.

2. Methodology: The Beyond Zero Architecture

The paper proposes "Beyond Zero," a new security paradigm that shifts the trust boundary from the application level to the individual action performed on a specific resource. This architecture operates at machine speed, performing per-resource and per-method access decisions for both humans and agents.

The architecture consists of four cooperating components forming a continuous feedback loop:

4.1. Autonomous Governance (The World Model)

Before decisions are made, the system constructs an accurate "Enterprise Security World Model" to understand the terrain. This involves pre-processing data from HR, project management, and identity systems to generate static attributes for low-latency access decisions:

• Who: Attributes of accessors (humans and agents), including role, seniority, and the "controlling human" for agents.
• What: A semantic understanding of data sensitivity (e.g., "crown jewels," "user data") translated into structured resource models.
• How: Context regarding work assignments and historical usage patterns (e.g., a user assigned to Customer A should not access Customer B's data).
• Principle: Pre-compute reasoning outputs to minimize real-time overhead, ensuring high-fidelity determinations without latency.

4.2. Event Intake

The system ingests high-fidelity event streams to build a holistic view of user behavior and enterprise patterns:

• Server-side: Access logs from proxies, APIs, and productivity apps.
• Client-side: On-device signals (browser state, local file access, process activity) from DLP solutions and endpoint agents.
• Agent Activity: Logs of prompt inputs, execution plans, and tool invocations to verify alignment between agent actions, user intent, and enterprise policy.
• Storage: Data is stored in a "hot cache" for fast policy evaluation and a long-term datastore for detailed analysis and pre-processing.

4.3. Reasoning Engine (Static and Dynamic Decisions)

This is the core decision-making component, a hierarchical AI system that answers: "In the context of what we know about the user and the resource, is this specific action safe?"

• Fast Path (At-Access-Time): Performs granular attribute-based access control (e.g., blocking a VIP user's data access from a support tool) to allow or deny requests instantly.
• Slow Path (Post-Access/In-Flight): Detects complex anomalies (e.g., a user accessing 500% more files than peers) and triggers interventions.
• Outputs: Decisions result in Allow, Deny, or Challenge. These decisions feed into out-of-band risk evaluations that become attributes for future assessments.

4.4. Challenge Infrastructure

This component manages exceptions through two mechanisms:

• Challenges: Granular, context-aware requests for additional information to resolve ambiguity (e.g., "Explain why you need this file," "Touch security key," "Manager approval for bulk export"). These are designed to be statically verifiable but can include dynamic checks (e.g., real-time justification against document content).
• Containments: Durable "stop signs" that revoke access in response to perceived risk. Unlike challenges, containments may require security team intervention to lift, even after a challenge is passed.

3. Key Contributions and Features

The Beyond Zero model introduces five distinct features that differentiate it from legacy Zero Trust:

1. Resource/Action-Based Security: Authorization is made for individual actions on individual resources, regardless of the access method (API, MCP, front-end), rather than provisioning access to a whole tool or application.
2. Blended Static and Dynamic Security: It applies granular static policies as a baseline ("floor") while layering dynamic controls ("ceiling") for risky scenarios. This avoids the verification challenges of a fully dynamic model while allowing for intent-based reasoning.
3. Automatically Enriched Context: Decision systems continuously draw on context regarding the user, their work, the data, and available risk mitigations.
4. Automated In-Depth Investigation: Risk signals can autonomously trigger investigations that activate challenges or containments immediately, rather than waiting for post-factum review.
5. Dynamic Challenges and Containments: Policies can directly trigger specific friction points (e.g., security key touches) tailored to the risk level, reducing disruption for legitimate users while stopping malicious actors.

4. Results and Validation

The paper does not present quantitative experimental results (e.g., specific reduction in breach rates or latency metrics) from a deployed pilot. Instead, it validates the model through conceptual scenarios and architectural logic:

• The "Curious Contractor" Scenario: Demonstrates how the system identifies an external party using stolen credentials attempting to access data outside their scope, triggering a challenge for justification or approval.
• The "Suddenly Foolish Administrator" Scenario: Illustrates how the system detects an admin performing low-value queries followed by rapid, agent-assisted operations, triggering a security key challenge to prevent compromise.
• The "Rogue Agent" Scenario: Details a case where an AI agent (SalesGenie) attempts to access highly confidential strategic data. The Reasoning Engine detects a mismatch between the user's work assignment and the data's sensitivity, triggering a multi-step intervention (human confirmation, owner approval) and eventual containment if challenges fail.

These scenarios demonstrate the model's ability to mediate thousands of decisions per second, distinguishing between legitimate high-speed agent activity and malicious or misaligned behavior.

5. Significance and Claims

The paper positions Beyond Zero as a necessary evolution for the "Agentic Era." Its primary claims are:

• Paradigm Shift: The "Application Boundary" model is obsolete. Trust must move from the application level to the individual action level to secure data against machine-speed threats.
• Self-Defending Enterprise: By coupling static authorization with dynamic, AI-driven reasoning, the architecture enables an enterprise capable of mediating thousands of decisions per second, fusing access management and security operations into a single feedback loop.
• Strategic Necessity: As AI agents join the workforce and business velocity accelerates, security must operate at machine speed to remain effective.
• Call to Action: The authors call for industry collaboration to develop standards for:
  • Open architectures for agent introspection (e.g., standardized APIs for chain-of-thought analysis).
  • Agentic identity standards (attributing actions to specific agents, users, and tasks).
  • Frameworks for safe reasoning engine integration in SaaS services.

The paper concludes that Beyond Zero represents the future of enterprise security, moving toward a model where security acts as an immune system that continuously adapts to the context and intent of every request.