Google Beyond Zero makes intent the security boundary. Should we infer it or prove it?

Inferred Intent versus Proven Intent

The distinction below is the conclusion of this article. The rest explains why the end-to-end principle leads us here.

That is the destination. To understand why it matters, we need to go back to the architectural principle that made the Internet work in the first place.

The "one neat trick" that made the internet reliable

Let me tell you a story.

When the Internet evolved, its engineers separated the concerns of what function needed to happen at different communication “layers”. For instance, pushing raw data (a packet) through a wire (hardware layer) was separated from verifying and assembling the packets (network layer), which again was separated from gathering and ordering these packets into a stream of meaningful data (transport layer). The ensuing data stream could then be funneled to a program (application layer) to create an illusion of a stable connection without the program needing to worry about how this magic happened. These layers make up the OSI model (specifically TCP/IP) for communications, and are painfully familiar to those who have had to tackle networking.

The layered approach to communication emerged after engineers repeatedly ran into a question when designing the network: which parts of the network should guarantee the reliable transfer of data? Reliability here meant that all the data should be received free from errors and in the correct order. Sensibly, routers in the network could check every packet for errors, and even retransmit lost or corrupted packets, right? However, the engineers found that trusting routers with reliability was futile. The reason is this: only the endpoints have enough context and visibility to detect and handle the problems in transmission. Since endpoints thus needed to implement all the reliability logic anyway, anything beyond trivial error checks on the router (at the hardware and network layers) is necessarily incomplete and redundant. The response is then to avoid such redundant work by intermediaries and simplify.

This is the “end-to-end” principle: functions like correctness, reliability, encryption, and error recovery should be made on the endpoints at the highest layer possible.

The layered OSI design that underlies today’s internetworking is fundamentally shaped by this argument. Reliability, for instance, is ensured only on endpoints at the highest layers: TCP (transport layer) handles packet ordering and retransmission, and the application layer may check if the data has the correct checksum. There is an illustrative story of how the French X.25 networks, used by Minitel and others for years, lost to the U.S. ARPANET, the precursor of the modern Internet, in part due to X.25 taking the philosophy of entrusting routers with reliability, which made them far too complex to scale. The lesson is that when you’re designing a layered system, don’t expect too much from the lower levels.

End-to-end argument + cybersecurity = zero trust

Intriguingly, the end-to-end argument very much applies to cybersecurity, just as it does for reliability. I wrote this blog post because we so often forget about the power of this principle. But how does it apply?

Back in 2014, Google published its famous BeyondCorp paper that dispensed with the notion of the network layer (think VPNs) providing meaningful security. After all, how could the network layer know the intent of their users? Or even which user was genuinely logged on? There turned out to simply be too many ways for attackers to move laterally past “are you logging in from network X?” checks, from hijacking identities (valid identities are the top entry point in one third of intrusions, IBM X-Force, 2025) to living off the land (79% of initial access attacks are malware-free, CrowdStrike, 2025). Everything resting on the network layer erroneously trusts that the hijacked credential is genuine and therefore accepts the session itself.

The BeyondCorp paper used the end-to-end argument to shift the full burden of proof and verification onto endpoints. The approach evolved into what cybersecurity marketers have been calling “zero trust” architecture. Unfortunately, organizations struggled to implement Google’s BeyondCorp vision. In part, the zero-trust approach needs the endpoint devices to be trustworthy and unhacked, which is a tenuous assumption (Google makes its own hardware which gives them a better trust basis than most organizations). Gradually, the zero-trust term became hopelessly muddy after being hijacked by marketing expedience to focus exclusively on minimizing trust in the network and conveniently disregard the vast fields of vulnerabilities that exist in modern endpoints. Today’s hodgepodge of “zero trust” solutions thus trust a lot and verify only a little.

Let’s bring the neglected endpoint back into the fold and reconsider cybersecurity directly through the end-to-end principle.

We will assume that the user is using their local endpoint to orchestrate an action on a remote computer.

Under the end-to-end argument, ensuring the security of such commands should then be performed at the highest possible level on each of the two endpoints. (Intuitively, the routers and middleware between the endpoints have limited security function so enforcing security only on the endpoints makes sense.) The question then is how we achieve such security --- a question that quickly surfaces the hard problems of endpoint integrity and, above all else, trust.

If the trust boundary moves all the way to the individual action, the security system must decide what evidence it will trust at that boundary. Context can inform the decision. It cannot prove the person behind it.

Whose trust do we need? Operators?

Agentic AI has become the universal accelerant of cyberspace, hitting the gas pedals for both attackers and defenders in the online arms race. Relative to only a couple of years ago, today’s reality confronts unprecedented challenges: 10x data production rates, incredible growth of threat surfaces, and rapidly accelerating attack speeds. For the last point, Mandiant’s most recent figure is that the median time from initial access to hand-off to a second attacker is now 22 seconds, down from more than 8 hours in 2022 (Mandiant, M-Trends 2026). The fastest quartile of attacks encountered by Palo Alto completed in less than 72 minutes, 4x faster than the previous year (Palo Alto, Unit 42 Global Incident Response Report, 2026).

These fast attacks render after-the-fact detection largely moot. Attackers can simply abuse the user’s overprovisioned permissions (most organizations never defined the full authorization contours required for a role) and outrun the SecOps review. The reviews become reactive archeological digs into “how did we get hacked?” rather than mounting a defense. Eerily, the very idea of a human-manned Security Operations Center (SOC) now intercepting and thwarting an ongoing attack is dead.

Okay, so we’re not trying to convince operators that we made the right decisions. But who then needs to know that we are trustworthy?

Rethinking Zero Trust to go "Beyond Zero"

Beyond Zero is Google’s proposed security model for authorizing individual actions on specific resources at machine speed. It extends BeyondCorp by combining static authorization policies with contextual AI reasoning, challenges and containment for humans and AI agents.

On July 20, researchers at Google (including Michal Zalewski of American Fuzzy Lop fame) published a vision paper in ACM Queue titled Beyond Zero: Enterprise Security for the AI Era.

The architecture centers on autonomous governance. Specifically, they envision an AI-maintained "enterprise world model" that takes in events (think server, client, and agent telemetry) and couples them with a reasoning engine. This engine combines a static policy floor (such as “for this event, most users do X”) and a dynamic AI ceiling (think “given the intent in the AI prompt, X+Y is reasonable”), allowing each event to be mapped into an allow/deny/challenge governance verdict. In other words, it maintains a model of the enterprise, consumes telemetry, and infers whether a given action looks appropriate. Crucially, the verdicts are doled out autonomously, all the time, like a dynamic immune system (an analogy used by the authors) that scrutinizes the context of every request. When confidence drops, the system introduces friction: a justification prompt, a manager approval, a security-key touch, or a selfie picture of the user sitting and interacting with their computer. Their word for the property they are evaluating is intent.

Beyond Zero therefore puts intent at the center of authorization. The remaining question is which parts of that intent should be inferred, and which can be proved.

Why Beyond Zero eventually reaches for proof

If history is a guide, the cybersecurity industry is about to spend two years using the same term for incompatible things.

There is an important distinction we have been making for a while:

• Inferred intent is a probabilistic guess about what a user or an agent meant, produced by a learning model watching behavior and context.
• Proven intent is cryptographic (non-repudiable) evidence that a real, authorized person is behind each action, human or not.

These definitions are precise. Intent is not a guess about what a user or agent meant to do, but an actual proof.

The Beyond Zero authors recognize this importance. When the stakes are high enough, their architecture reaches for a security-key touch. Their system demands physical presence, because in the moment an operation really matters, inference alone cannot provide trustworthy security. Instead, the highest-value question it can ask is whether a real, authorized person is actually behind this action, and that is the one it currently answers by interrupting somebody. Even when you can trust the authorized user, you still need proven intent for any action – particularly when circumstances are unusual. This neutralizes the adversaries who would otherwise lurk in the shadows, impersonating privileged users, and abusing standing access. Proving and verifying intent is an end-to-end approach to assuring integrity and security.

Our answer: use the physical input already there

Beyond Zero asks for physical confirmation when inference is no longer enough. Keystrike starts from the same requirement but avoids turning proof into an occasional interruption.

In a human-operated session, the physical input already needed to perform the action creates device-bound cryptographic evidence. There is no separate security-key touch for each high-value command. For agentic activity, the physical evidence anchors the authority delegated by a specific person.

We built Keystrike, an intent-based security platform for AI agents and privileged access, to provide one control, applied in three places: verify every action is bound to an authorized person, across remote sessions, agentic work, and third-party access. This is Intent-Based Security, delivered by Keystrike as the Intent-Based Security Platform. Here, intent means a real, authorized person is behind the action, proven with cryptographic evidence, not a model’s estimate of purpose. Notably, by piggybacking verification on the physical input needed to take the action, no workflow changes are needed.

Where each of the three stands today:

The Beyond Zero paper closes with a standards call: an industry standard for request annotations that makes every agent action attributable to a specific agent, a specific controlling user, and a specific task. This is music to my ears because we already do that. Device-bound cryptographic person-binding is a working implementation of the attribution property they are asking the industry to standardize -- already shipping for human sessions, extending to agent actions through early access. We intend to engage with the NIST agent-security effort on exactly that basis. If you’re working on it or related areas, I’d welcome a conversation.

Intent is the new perimeter

The largest security organization in the world has now told the industry that the trust boundary is the individual action, and that the question every decision must answer is intent. This is the epitome of the end-to-end argument -- I doubt there is much left to argue about there.

Intent is the new perimeter. What is left to decide about is whether you infer the answer or prove it. My position, not-so-shockingly, is that you should prove the part that can be proven and infer the rest, and that the part that can be proven is the person.

Check out the paper and then bring me your hardest question about it. If you think per-action proof is impractical at your scale, or that continuous attestation is a nice idea that falls over in a real environment, I would genuinely like to hear the argument -- those conversations are not just fun but also how this product got good.