Beyond Zero: Google Publishes Successor to BeyondCorp

Google introduced Beyond Zero as a zero-trust framework that treats AI agents as first-class security principals, answering the core question: how can enterprises guarantee model integrity at inference time? The research paper released in September 2026 outlines the technical stack, early pilot results, and the roadmap for production use. For the original announcement see the InfoQ article InfoQ.

Core technical pillars of Beyond Zero

  • Hardware-rooted attestation – Each AI agent presents a TPM-based measurement chain that cryptographically proves the exact model version, runtime libraries, and container image.
  • Federated policy engine – A distributed control plane evaluates requests against contextual attributes such as model provenance, data sensitivity, and execution environment before granting access to downstream services.
  • Zero-knowledge credential exchange – Agents use short-lived, non-transferable tokens derived from their attestation, preventing token replay across unrelated workloads.
  • Audit-first logging – Every policy decision is recorded in an immutable log that compliance tools can query in near-real time.

These components create a “trust-but-verify” loop that operates at inference time, not just at deployment.

How Beyond Zero differs from BeyondCorp

BeyondCorp focused on human users and device posture. Beyond Zero flips the paradigm:

  • Principal shift – AI agents become the identity holder; they receive cryptographic identities tied to model hashes.
  • Dynamic policy – Policies react to model drift, dataset changes, or emerging vulnerabilities without human intervention.
  • Hardware dependency – The model assumes widespread TPM or AMD SEV support in cloud VMs and edge devices, a requirement that was optional in BeyondCorp.

The result is a security fabric that can automatically quarantine a compromised model version while allowing unaffected agents to continue operating.

Implications for enterprise AI pipelines

  • Credential re-architecture – Existing service-to-service OAuth flows must be replaced with attestation-backed tokens, forcing a rewrite of CI/CD pipelines that provision AI workloads.
  • Compliance acceleration – Immutable audit logs satisfy many regulatory demands (e.g., GDPR data-processing records) out of the box, reducing the need for separate logging stacks.
  • Performance trade-offs – Attestation adds roughly 15 ms latency per request on typical Cloud TPU instances; Google claims hardware acceleration can cut this to under 5 ms for high-throughput workloads.

Enterprises using Google Cloud’s Vertex AI will need to enable the new control plane and migrate model artifacts to the attested registry.

Required hardware and software stack

  • TPM 2.0 or AMD SEV on every node running AI inference.
  • Google’s Attested Model Registry (AMR) – a signed artifact store that records model hashes and provenance metadata.
  • Policy SDK – a lightweight library (available in Go, Python, and Java) that integrates with inference servers to request and validate tokens.
  • Supported hardware – Cloud TPU v4, NVIDIA H100 with confidential compute, and upcoming custom ASICs that expose attestation hooks.

Without these components the framework falls back to a permissive mode that only logs policy violations.

Early adopters and ecosystem response

  • Financial services – Two major banks are piloting Beyond Zero to obtain real-time auditability of credit-scoring models.
  • Healthcare AI – A consortium of hospitals plans to enforce HIPAA-compliant data handling for diagnostic imaging models.
  • Open-source community – Google released the Policy SDK under Apache 2.0, prompting rapid forks that add support for non-Google runtimes like ONNX Runtime.

These pilots will generate the first performance benchmarks and compliance reports.

Risks and open questions

  • Vendor lock-in – The attested registry is tightly coupled to Google Cloud; cross-cloud attestation bridges are not yet standardized.
  • Supply-chain complexity – Managing model hashes across multiple training pipelines can become cumbersome, especially for organizations that reuse pre-trained checkpoints.
  • Regulatory ambiguity – While audit logs satisfy many current rules, regulators are still debating whether attestation-based tokens qualify as “electronic signatures” under e-IDAS.

Enterprises should start a governance review now to map these gaps.

What to watch next

  • General Availability timeline – Google promises a phased rollout beginning Q1 2027, with beta access for select Cloud customers.
  • Standardization efforts – The Cloud Native Computing Foundation (CNCF) has announced a working group to define a vendor-neutral attestation API, which could mitigate lock-in concerns.
  • Integration with LLM-driven security – Early experiments combine Beyond Zero with LLM-based policy generators, hinting at a future where policies adapt autonomously.

For teams looking to experiment with model security, the open model weights repository on Hugging Face now hosts example attested models that can be tested with the Policy SDK open model weights.

Broader industry movement

The shift mirrors a broader trend where AI agents are treated as independent services. Anthropic’s recent lawsuit over internal chat data highlighted the need for clear provenance and audit trails, reinforcing why Google’s attestation approach could become a de-facto standard.

Bottom line for developers

  • Update your CI/CD – Add a step that registers model hashes in the AMR.
  • Instrument inference servers – Deploy the Policy SDK to request attestation tokens before each external call.
  • Plan for latency – Benchmark workloads with the extra 5-15 ms overhead and adjust autoscaling policies accordingly.

Beyond Zero is not a plug-and-play upgrade; it demands architectural changes. However, for organizations that must prove model integrity to regulators or customers, the framework offers a concrete path forward.

Related coverage

Explore more on this topic