Article URL: https://khessin.de/twelve-years-without-a-vpn/ Comments URL: https://news.ycombinator.com/item?id=49136061 Points: 7 # Comments: 1

At Google, access to internal applications depends on the user and the device, not on the network. This has been the case since the BeyondCorp transition. There is no client to start and no token to type. The only time I notice the system at all is when I postpone an OS update for too long. Access then degrades quietly until I install it. That is the whole model in a single experience: trust is a property of your device and your identity, not of the network you sit in. Yesterday Google announced the successor: Beyond Zero. I want to write down my read of it now, at the start. In 2014 almost nobody took the first paper seriously in time, including most of the security industry. The original paper by Rory Ward and Betsy Beyer appeared in USENIX ;login: in December 2014. The PDF is still online and takes maybe twenty minutes to read. The claim: the internal network is as dangerous as the public internet, so the perimeter cannot be a boundary of trust. Google removed the privileged network entirely. All applications went behind an internet-facing proxy, in public DNS, and every request was authorized individually based on user, group, device certificate and a trust tier that changes with the state of the device. The part most people skip is the migration, and it is the better half of the paper. Google collected netflow data from every switch, ran a simulator of the new network on every employee laptop, and moved a person only after thirty consecutive days with more than 99.9 percent compatible traffic. Nothing broke. Most of the stalled zero trust programs I have seen since skipped exactly this step. Five more papers followed, on the proxy, the migration tooling, the user experience and the fleet. NIST standardized the model in 2020 as SP 800-207, the US government mandated it for federal agencies in 2021, and at some point every RFP had a zero trust section. I have also sat in presentations where zero trust meant, as far as I could tell, a firewall with better marketing. That is what winning looks like for an idea in enterprise IT. There is a question I now hear in almost every enterprise AI conversation: what exactly is our agent allowed to do? The honest answer in most organizations is: whatever the service account of whoever built the pilot can do. Nobody decided that. It accumulated. Zero trust does not help here. It verifies the user and the device per request, and after that the session can do whatever the application permits. For humans that was acceptable, because humans are slow. A stolen credential in 2015 was dangerous at typing speed. A stolen credential in 2026 is dangerous at software speed, and the same is true for a legitimate agent that misreads its task. Beyond Zero moves the decision one level down. Not “may this identity access the finance system” but “may this identity perform this specific action on this specific record, in this context.” Reading one record and exporting fifty thousand records become different authorization questions. The first technical paper is in ACM Queue, and the announcement promises follow-up papers with implementation detail, same as the original series. Deployments are internal so far. We are at the 2014 point of the curve, not the 2020 one.