Beyond Zero answers what the machine decides. It does not answer who said it could.

Google has published Beyond Zero: Enterprise Security for the AI Era. The proposal is a real shift, and worth reading properly rather than through the headline. Beyond Zero moves the trust boundary from the application to the individual action taken on a piece of data, evaluated in the moment rather than reconstructed afterwards. It augments BeyondCorp's identity substrate with a reasoning layer that judges the context and intent of a request at the time the request is made. Decisions are allow, deny, or challenge. Challenge is the interesting one: the system can ask for justification, verification, or biometric confirmation rather than dropping to a binary.

The Hacker News thread on it converged, within a few hours, on the objection that matters. Zero trust is deterministic. A model is not. Putting a non-deterministic evaluator in the access path means the boundary is now inconsistent, and compromising the evaluator becomes the new attack. Several commenters landed on the same place independently: this is a fancy way of asking an LLM whether you are allowed in, and the signals it reasons over can be manipulated.

That objection is close to right, but it is aimed one layer too low.

The gap is not determinism. It is legitimacy.

The question is not whether a probabilistic component belongs in the enforcement path. Probabilistic components are already there. Every EDR product, every behavioural analytics platform, every managed WAF ruleset is a model making a call and acting on it. The question is what establishes that any given system has the right to act in your environment, against your traffic, under your conditions.

Google can leave that question unanswered because for Google it does not arise. They built it, they run it, they have the telemetry, and the operator and the vendor are the same organisation. The paper describes what works at Google, which is a legitimate and useful thing to publish.

The moment this leaves Google, the asymmetry appears. An operator adopting a Beyond Zero style architecture inherits accuracy claims tested against a dataset they did not select, under conditions they do not control, with metrics that may not transfer to their environment at all. That is vendor-asserted trust. It is the oldest failure mode in defensive security, and no amount of reasoning-layer sophistication resolves it, because the problem is not the reasoning layer's quality. The problem is that the operator has no independent basis for believing anything about it.

Responsible operators respond to this rationally: they keep the human in the loop, accept the latency cost, and hope the attacks they face are slow enough to catch. Given the options available, that is the correct decision. The options are incomplete.

Rehearsal, not assertion

I published a framework for this in January, On Earned Autonomy: Delegating Network-Lethal Authority to Machines (DOI 10.5281/zenodo.18406828). The argument is that defensive authority works like identity and access management applied to machine judgment rather than user access. It must be demonstrated before it is granted, scoped when granted, and continuously revalidated or revoked.

The mechanism is separation. In the reference implementation, IBSR observes live production traffic and produces judgment without acting on it, recording every decision it would have made. Guard executes enforcement in kernel space. Nothing crosses from the first to the second without a counterfactual record showing what would have happened.

That record is the whole point. If the system would have been wrong, you have an environment-specific answer and you never grant authority. If it would have been consistently, measurably right, the burden of proof inverts. The question stops being whether you can justify trusting the machine and becomes whether you can justify continuing to prevent it from acting, given that the cost of that prevention is now itemised in the record as attacks that succeeded while waiting for approval.

Authority granted this way is bounded, revocable, and continuously re-earned. It does not require the evaluator to be deterministic. It requires the evidence to be yours.

Where this bites hardest

Enterprise access control is the gentler case. There is a SOC, an escalation path, and a challenge flow. Beyond Zero's challenge mechanism is a genuinely good idea and there is no equivalent in my framework, which is a gap on my side.

Distributed infrastructure has none of that. When hostile or malformed inputs arrive at a validator's P2P or RPC boundary, the decision window is sub-second, there is no analyst, and the consequence of getting it wrong is measured in slashing and availability loss rather than a ticket. That environment forces the authority question into the open faster than an enterprise ever will, which is why NullRabbit's work sits there.

Beyond Zero and earned autonomy are answering different halves of the same problem. Google has described what the machine should decide. The open question, and the one that determines whether any of this ships outside Google, is what gives it the standing to decide at all.

Beyond Zero: Enterprise Security for the AI Era, Google: spawn-queue.acm.org/doi/10.1145/3819083

On Earned Autonomy: Delegating Network-Lethal Authority to Machines: papers.ssrn.com/sol3/papers.cfm?abstract_id=6067848