I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already been in use for years when it comes to anomaly detection. Maybe modern LLMs can be used to automate access control, partially or fully at enterprise scale in the future. The idea is to have a policy engine that's controlled by AI that uses a mix of long-term semi-static info such as group memberships and permission boundaries, short-term info such as behavior (e.g. access logs) and current session's authentication strength level (AAL) such as FIDO as well as near real-time external information (e.g. IdP, SIEM, threat intelligence, on-call management) to dynamically adjust users' access control to build up some sort of a context for each user and each session that can increase or decrease permissions without having to manually add policy rules or going through request/approval flows, while optimizing for the main objective (i.e. minimizing access grants for every subject to any resource under whatever context unless when it's necessary). This can be unified for both humans and non-human identities, including agents.

+1000, and the role of non-deterministic security is to compose deterministic security primitives.

Deterministic executes fast and you know what it will do. You want to evolve your ground truth, not hope for the best.

That said, there is a role for probabilistic elements in the security model...as bait and signal.

From Google point of view, their users are nothing more than a statistic. An hacked account is a statistic. No surprise they see software that way.

I completely agree.

I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.

The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.