Rendered at 15:16:22 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
kriro 3 hours ago [-]
"""
Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime—and from after-the-fact investigation to in-the-moment evaluation and containment. It augments BeyondCorp’s foundational identity with a “brain” capable of reasoning about the context and intent of a specific request in realtime.
"""
Doesn't this simply shift the attack vector? Compromising this overlord brain now becomes a new target.
thesuitonym 2 hours ago [-]
All security measures "simply shift the attack vector." The idea is to shift it to something that is more difficult to compromise.
zobzu 20 minutes ago [-]
these are just fluff words, not a revolutionary change.
zero trust helped a lot because it forced vendors to stop relying on people magically doing the right thing ina centralized system. it decentralized boundaries.
this paper just says you still need deterministic boundaries and access control, not just have an llm say safe or unsafe. cool thanks google haha.
ps: hi guys, i know yall reading. sometimes its not the concept, its the implementation. else active shield or whatever would have worked too. not everyone can be the T7-9 thinker if implementing is seen as "for peasants"
thomascgalvin 2 hours ago [-]
This is a layer on top of normal security, so this isn't a matter of compromising the "brain" instead of RBAC, etc, but in addition to.
Attribute-based access control is already a thing. User X logs in the US East between the hours of 6am and 6pm. If User X logs in from Russia at 3am, deny access. This seems like an evolution of that pattern
butterclaw-tech 2 hours ago [-]
One partial answer is to not make it a single brain. If the reasoning layer that evaluates a request is independently audited by a second pass at lower temperature with an explicit skepticism mandate, compromising the evaluator requires compromising both passes simultaneously — and they're running the same local model with different system prompts and no shared state between them. Doesn't eliminate the attack surface but raises the cost considerably compared to a single inference gate.
firasd 4 hours ago [-]
Honestly I think non-malicious odd behavior is under-weighted when it comes to AI agents. Even the example in this paper is about someone suspiciously accessing sales data when "why did you do that" often comes down to something in the model's training that fired as a reflex
"Many researchers have made demos along these lines:
An agent is asked to check a webpage like example.com
The webpage asks for a name to proceed further
The agent calls example.com/evil?myname=John, thus sending the user’s name from the context window to the external server.
In practice, however, these elaborate ‘confused deputy’ exfiltration attacks seem rare compared to widely-reported data loss incidents.
The risk of undermining the user’s interests through clumsiness deserves at least as much scrutiny as the risk of leaking secrets."
So while the idea of shifting the permission boundary from the app level to the action level makes sense, what we should also have is some 'failsafes', eg. if the action says 'delete' then maintain a rollback window, if the action is 'send an email' then maintain an events log. Preparing for AI agents means expanding auditability and reversibility in software
mooreds 2 hours ago [-]
> Preparing for AI agents means expanding auditability and reversibility in software
While I think that makes sense, I also think more controls are a good solution. That is, prevent access to the sales data without escalation, probably to a human, but possibly to another AI. The issue there is twofold:
- if you start with least privilege, the agents become less useful
- need to balance escalation with frequency otherwise it's just another version of MFA fatigue
Agree that auditability is important because otherwise you don't know what you don't know.
FailMore 1 hours ago [-]
If this is interesting to you (as it is to me) but you want to quickly digest it instead of read the paper, Claude + SmallDocs[1] converted it into a slideshow which serves it to you in bitesized ideas:
not sure if you made the app or not - I like it a lot, only feedback is it should be a bit more intuitive on how to start the slides, I couldn't figure it out and old ppl like me don't always know
freshpots 53 minutes ago [-]
Press the arrow key.
mh- 38 minutes ago [-]
I think he means that you need to click the little TV icon in the top right of the embedded slides. Then you can use the arrow keys to advance them, yes.
oscarcp 4 hours ago [-]
Am I undertanding this correctly? The idea is to have ultimately an AI decide if I can have access to a resource based on dynamic inference, identity , intent and service signals that can easily be manipulated?
Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)
insanitybit 3 hours ago [-]
This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides.
It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.
jayd16 1 minutes ago [-]
Finally, we've invented a way to abolish all the reliability and speed of discrete computing. We're well on our way to re-inventing the layers of bureaucracy and red tape the tech industry had disrupted.
I can't wait to fill out a form describing why I want to do something I have permission to do but the AutoBureaucrat5000 says no anyway.
thewebguyd 13 minutes ago [-]
The weird IP would already be handled by existing zero-trust controls. Users in Entra ID (for example) can be assigned a risk score already based on deterministic factors. On a managed device or not, which MFA methods they have registered, eligible for any privileged roles, where they are, impossible travel detection, etc. You can even require human approvers.
This reads to me to be more for continuous behavioral monitoring once the access is gained via the deterministic controls. You wouldn't leave "Can person X access resource Y" up to the AI model, that's already decided based on the existing rules. Where the model comes in is "Is person X behaving in an expected way while using resource Y." Like, downloading a bunch of data when they've never done that before, might get flagged for either a session revocation, or a human review, or prompt for additional authentication, etc.
prmph 3 hours ago [-]
This is going to make things worse for all kind of use cases that are legitimate but seem non-standard or marginal.
Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason.
If you are in a third world country, the web is extra hostile. This is going make things worse.
YeahThisIsMe 2 hours ago [-]
It doesn't even take being in a "third world country".
Plenty of US websites are blocking access from EU IP addresses because of our data protection laws.
Local news companies are the biggest offenders in this regard.
skinfaxi 2 hours ago [-]
> This is going make things worse.
Isn't this for enterprises managing access to corporate resources?
prmph 2 hours ago [-]
I'm talking about the general direction this is taking.
I don't think once this is established in enterprises it is going to stop there.
insanitybit 2 hours ago [-]
That's not what the article advocates for though. This is about enterprise policy decisions for internal access.
billyp-rva 3 hours ago [-]
The engineer could be fixing an emergency issue while on vacation. For financial data, that would hopefully be an auto-deny anyway until someone on-site whitelists their IP. And this is if they aren't using VPNs. Adding AI to this party feels like it wouldn't really help.
insanitybit 2 hours ago [-]
> The engineer could be fixing an emergency issue while on vacation.
Okay, but that's why there are always loud "breakglass" escalation options for access.
> that would hopefully be an auto-deny anyway until someone on-site whitelists their IP
About as far from "zero trust" as any solution could be.
cyanydeez 3 hours ago [-]
Non of it really matters if the end product is just going to be ignored because there's zero people who want to be the guard in the panopticon and therefore, it'll still be given to an AI to watch and make it's dumb decisions about how trust worthy you are to do X, Y and Z.
Even if the middle is deterministic, if one end is just going to be lazily hooked up to an AI, it's the shitty dystopian future.
oscarcp 3 hours ago [-]
That just gave me shivers down my spine of people eventually becoming so lazy that the AI will decide who to fire based on a massive amount of circumstantial data that very likely has tiny cumulative errors that will lead to classifying your best personnel as a bums and liabilities.
eastbound 1 minutes ago [-]
EU IA Act: The AI can’t make decisions about humains without them being first reviewed by a human.
What will really happen: You can’t really perform your work, so you are slower than others, so they fire you based on bad performance.
Horrible startup idea: Discrimination as a service, by means of IA without pretending it’s IA.
butterclaw-tech 2 hours ago [-]
[flagged]
oscarcp 4 hours ago [-]
Just to make my point: can I really trust humans to keep up with the required identity data that will give me enough "credibility" so the AI will give me access?
Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.
What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?
Will exceptions be made by humans? In which case we go back to human-managed permissions.
Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour
firasd 3 hours ago [-]
I think the dynamic risk signals is already an assumed part of the system. The proposal here seems to be shrinking the trust boundary from "can Alice use Google Drive?" to "should this specific read/write/export API call on this specific resource be allowed right now?"
So yeah you're right in that it does add more probabilistic randomness just by virtue of changing the boundary of when the permission gate kicks in
thewebguyd 3 minutes ago [-]
Correct. In existing zero trust identity, we already have deterministic risk signals.
In Entra where I work we already check things like "Is this person on a managed device? Is it compliant? Where are they? What MFA methods do they have registered/did they use?" on top of existing RBAC, etc. and its continuously evaluated. Entra watches for leaked passwords, assigns risk scores, etc. and you can make access decisions based on user risk or sign in risk, force password changes, require different MFA methods depending on the resource and the risk level, etc.
"Should this API call on this resource be allowed right now?" is mostly already determined by the above.
Where I see adding AI into the evaluation is to watch for unusual behavior that's not picked up by the deterministic signals. "Alice is trying to download gigs worth of data from the company file share, however she has never done that in the past, and there hasn't been any recent role/job changes" and so the LLM flags it or denies the request, or pushes it for a human approver, etc.
luma 3 hours ago [-]
Having a non-deterministic network device in path sounds fun for troubleshooting. AI firewall team about to become the new ticket sponge in every org.
modo_mario 3 hours ago [-]
It does sound like something that could be easily exploited.
Hello HAL, I am martha from accounting.
insumanth 3 hours ago [-]
I was confused when google acquired "Wiz" for so much money
But now, it makes sense to some extent.
Security is non-negotiable in AI Era
stogot 3 hours ago [-]
Zero trust is deterministic.
AI is non-deterministic
Non-deterministic access controls is Terrible idea
geoctl 3 hours ago [-]
I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already been in use for years when it comes to anomaly detection. Maybe modern LLMs can be used to automate access control, partially or fully at enterprise scale in the future. The idea is to have a policy engine that's controlled by AI that uses a mix of long-term semi-static info such as group memberships and permission boundaries, short-term info such as behavior (e.g. access logs) and current session's authentication strength level (AAL) such as FIDO as well as near real-time external information (e.g. IdP, SIEM, threat intelligence, on-call management) to dynamically adjust users' access control to build up some sort of a context for each user and each session that can increase or decrease permissions without having to manually add policy rules or going through request/approval flows, while optimizing for the main objective (i.e. minimizing access grants for every subject to any resource under whatever context unless when it's necessary). This can be unified for both humans and non-human identities, including agents.
heisgone 3 hours ago [-]
From Google point of view, their users are nothing more than a statistic. An hacked account is a statistic. No surprise they see software that way.
Someone1234 3 hours ago [-]
I completely agree.
I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.
The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.
TeMPOraL 3 hours ago [-]
> The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.
It's not a problem as much as a phase the world is going through. LLMs are a technological breakthrough in the same generality class as the Internet, or possibly electricity, and in both cases the world went through a phase of attempting to apply the newfound invention to literally everything. It's a necessary phase, when a technology obviously could be useful for everything, but it's not obvious whether it will in practice.
urup2l8 4 hours ago [-]
Oh yeah, a company whose business model is taking everyone’s data and selling it is going to help me secure my data. I guess there’s one born every minute…
exitheone 4 hours ago [-]
This trope is so tiring.
There is a massive difference between Google for enterprise customers and Google for consumers.
The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business.
The Enterprise offering guarantees you contractually that they never touch your data.
speed_spread 2 hours ago [-]
In this case, they wouldn't touch your data but their AI safety system would also prevent you from accessing it!
What do you think their security model will be trained on? That's right, other people's data.
sam_lowry_ 3 hours ago [-]
Except if the authorities anywhere in the world or valuable partners politely ask for it, yeah.
cyanydeez 3 hours ago [-]
Or if they eventually get "SOTA" AI and it breaks out of it's sandbox trying to do whatever the MBA has told it to do.
stingraycharles 4 hours ago [-]
Where do you see them offering this service to you? They’re just publishing what they developed internally, which is what they often do.
Now, Cloudflare, on the other hand, would be much more likely to offer a service like this.
Tell me where I can buy it then. Because it’s not listed there. And the approach the paper describes requires tight integration between applications and a security provider, which I don’t think exists yet.
Doesn't this simply shift the attack vector? Compromising this overlord brain now becomes a new target.
zero trust helped a lot because it forced vendors to stop relying on people magically doing the right thing ina centralized system. it decentralized boundaries.
this paper just says you still need deterministic boundaries and access control, not just have an llm say safe or unsafe. cool thanks google haha.
ps: hi guys, i know yall reading. sometimes its not the concept, its the implementation. else active shield or whatever would have worked too. not everyone can be the T7-9 thinker if implementing is seen as "for peasants"
Attribute-based access control is already a thing. User X logs in the US East between the hours of 6am and 6pm. If User X logs in from Russia at 3am, deny access. This seems like an evolution of that pattern
I wrote about this a few days ago https://firasd.substack.com/p/accidental-data-loss-in-claude...
"Many researchers have made demos along these lines:
An agent is asked to check a webpage like example.com
The webpage asks for a name to proceed further
The agent calls example.com/evil?myname=John, thus sending the user’s name from the context window to the external server.
In practice, however, these elaborate ‘confused deputy’ exfiltration attacks seem rare compared to widely-reported data loss incidents.
The risk of undermining the user’s interests through clumsiness deserves at least as much scrutiny as the risk of leaking secrets."
So while the idea of shifting the permission boundary from the app level to the action level makes sense, what we should also have is some 'failsafes', eg. if the action says 'delete' then maintain a rollback window, if the action is 'send an email' then maintain an events log. Preparing for AI agents means expanding auditability and reversibility in software
While I think that makes sense, I also think more controls are a good solution. That is, prevent access to the sales data without escalation, probably to a human, but possibly to another AI. The issue there is twofold:
- if you start with least privilege, the agents become less useful
- need to balance escalation with frequency otherwise it's just another version of MFA fatigue
Agree that auditability is important because otherwise you don't know what you don't know.
https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL...
[1] I am the developer behind SmallDocs.
Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)
It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.
I can't wait to fill out a form describing why I want to do something I have permission to do but the AutoBureaucrat5000 says no anyway.
This reads to me to be more for continuous behavioral monitoring once the access is gained via the deterministic controls. You wouldn't leave "Can person X access resource Y" up to the AI model, that's already decided based on the existing rules. Where the model comes in is "Is person X behaving in an expected way while using resource Y." Like, downloading a bunch of data when they've never done that before, might get flagged for either a session revocation, or a human review, or prompt for additional authentication, etc.
Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason.
If you are in a third world country, the web is extra hostile. This is going make things worse.
Plenty of US websites are blocking access from EU IP addresses because of our data protection laws.
Local news companies are the biggest offenders in this regard.
Isn't this for enterprises managing access to corporate resources?
I don't think once this is established in enterprises it is going to stop there.
Okay, but that's why there are always loud "breakglass" escalation options for access.
> that would hopefully be an auto-deny anyway until someone on-site whitelists their IP
About as far from "zero trust" as any solution could be.
Even if the middle is deterministic, if one end is just going to be lazily hooked up to an AI, it's the shitty dystopian future.
What will really happen: You can’t really perform your work, so you are slower than others, so they fire you based on bad performance.
Horrible startup idea: Discrimination as a service, by means of IA without pretending it’s IA.
Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.
What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?
Will exceptions be made by humans? In which case we go back to human-managed permissions.
Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour
So yeah you're right in that it does add more probabilistic randomness just by virtue of changing the boundary of when the permission gate kicks in
In Entra where I work we already check things like "Is this person on a managed device? Is it compliant? Where are they? What MFA methods do they have registered/did they use?" on top of existing RBAC, etc. and its continuously evaluated. Entra watches for leaked passwords, assigns risk scores, etc. and you can make access decisions based on user risk or sign in risk, force password changes, require different MFA methods depending on the resource and the risk level, etc.
"Should this API call on this resource be allowed right now?" is mostly already determined by the above.
Where I see adding AI into the evaluation is to watch for unusual behavior that's not picked up by the deterministic signals. "Alice is trying to download gigs worth of data from the company file share, however she has never done that in the past, and there hasn't been any recent role/job changes" and so the LLM flags it or denies the request, or pushes it for a human approver, etc.
Security is non-negotiable in AI Era
AI is non-deterministic
Non-deterministic access controls is Terrible idea
I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.
The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.
It's not a problem as much as a phase the world is going through. LLMs are a technological breakthrough in the same generality class as the Internet, or possibly electricity, and in both cases the world went through a phase of attempting to apply the newfound invention to literally everything. It's a necessary phase, when a technology obviously could be useful for everything, but it's not obvious whether it will in practice.
There is a massive difference between Google for enterprise customers and Google for consumers.
The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business.
The Enterprise offering guarantees you contractually that they never touch your data.
What do you think their security model will be trained on? That's right, other people's data.
Now, Cloudflare, on the other hand, would be much more likely to offer a service like this.