Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing Zero Trust with BeyondCorp · mukul975 | DecimalAI

Implementing Zero Trust With Beyondcorp

SkillScore29Maintained

implementing-zero-trust-with-beyondcorp

Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, and Access Context Manager to enforce identity and posture-based access to GCP resources and internal applications.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-zero-trust-with-beyondcorp/SKILL.md

decimalai skills pull implementing-zero-trust-with-beyondcorp --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-zero-trust-with-beyondcorp/SKILL.md https://app.decimal.ai/s/implementing-zero-trust-with-beyondcorp/SKILL.md

Raw file: /s/implementing-zero-trust-with-beyondcorp/SKILL.md ↗ · machine-readable summary at /s/implementing-zero-trust-with-beyondcorp.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

24 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +29% lift-6% tokens0% turns29% of whole cases pass with skill (7/24)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-15	✗→✓	▲ Improved	—	—
case-05	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-12	✗→✓	▲ Improved	—	—
case-17	✗→✓	▲ Improved	—	—

Showing 5 of 24 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-zero-trust-with-beyondcorp/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Implementing Zero Trust with BeyondCorp

Overview

Google BeyondCorp Enterprise implements the zero trust security model by eliminating the concept of a trusted network perimeter. Instead of relying on VPNs and network location, BeyondCorp authenticates and authorizes every request based on user identity, device posture, and contextual attributes. Identity-Aware Proxy (IAP) serves as the enforcement point, intercepting all requests to protected resources and evaluating them against Access Context Manager policies. This skill covers configuring IAP for web applications, defining access levels based on device trust and network attributes, and auditing access policies for compliance.

When to Use

When deploying or configuring implementing zero trust with beyondcorp capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Google Cloud project with BeyondCorp Enterprise license
IAP API enabled (iap.googleapis.com)
Access Context Manager API enabled (accesscontextmanager.googleapis.com)
GCP resources to protect (Compute Engine, App Engine, or GKE services)
Endpoint Verification deployed on managed devices
Python 3.9+ with google-cloud-iap library

Steps

Step 1: Enable IAP on Target Resources

Configure Identity-Aware Proxy on Compute Engine, App Engine, or HTTPS load balancer backends.

Step 2: Define Access Levels

Create Access Context Manager access levels based on IP ranges, device attributes (OS version, encryption, screen lock), and geographic location.

Step 3: Bind Access Policies

Apply access levels as IAP conditions to enforce context-aware access decisions on protected resources.

Step 4: Audit and Monitor

Query IAP audit logs, verify policy enforcement, and identify gaps in zero trust coverage.

Expected Output

JSON report containing IAP-protected resources, access level definitions, policy binding audit results, and zero trust coverage metrics.

Illustrative Want to see what implementing-zero-trust-with-beyondcorp would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 10:14 UTC · 24 cases

Lift

+29%

29% vs 0%

Agent turns

1.0 vs 1.0

Tokens

-6%

1,752.46 vs 1,860.13

fail → pass · 7fail → fail · 17

Per-case results (24)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 When configuring device-based access levels in Access Context Manager for managed corporate laptops accessing IAP-protected applications, what client-side agent or browser tool is required to collect device posture attributes such as OS version, encryption status, and screen lock settings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 A developer wants to know which Google Cloud platform compute backends support native Identity-Aware Proxy integration for zero-trust access control.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 What is the minimum Python runtime version required to run programmatic IAP policy management and audit scripts using the official Google Cloud IAP client library?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 To enforce screen lock and OS version policies via Access Context Manager for corporate endpoints, what deployment prerequisite must be met on user devices?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 You are writing an automated Python tool to assess your BeyondCorp Zero Trust posture across Google Cloud resources. The security team asks for a plain text summary email. What structured format and specific report components should the assessment output contain to properly audit the deployment?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 To enforce device health checks and geo-fencing for internal web apps, an engineer suggests writing custom Cloud IAM conditions using standard IAM policy bindings directly on Compute Engine instances. Which dedicated GCP feature should be used to define reusable access levels based on device posture (like screen lock and disk encryption) and geographic attributes, and which API powers it?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 An administrator created an Access Context Manager access level requiring encrypted disks and corporate IP ranges. They plan to apply this access level by attaching it to VPC Firewall rules. How should contextual access levels actually be applied to enforce user access to HTTP services protected by Identity-Aware Proxy?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When defining access level constraints in Access Context Manager to ensure endpoints meet enterprise security standards before reaching IAP resources, what specific device posture attributes can be evaluated?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 During a security review of a BeyondCorp rollout, how should an engineer verify that zero trust policies are actively enforced and identify unprotected web applications across the GCP organization?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 Beyond device posture, what network-level contextual signals does Access Context Manager support when evaluating incoming request authorization for Identity-Aware Proxy?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 What specific operational task in the BeyondCorp workflow detects gaps where web applications or endpoints are exposed without IAP protection or context-aware conditions?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When defining Access Context Manager rules for high-security internal tools, how are environmental attributes combined to form an access level?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 When protecting a Kubernetes service running on Google Kubernetes Engine (GKE) under a BeyondCorp Zero Trust model, where is Identity-Aware Proxy enabled and configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 You are developing an automated script in Python 3.9+ to programmatically inspect IAP settings, audit policy bindings, and verify BeyondCorp access configurations across GCP projects. Which official Google Cloud client library should be installed for this task?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-24 A security engineer granted the roles/iap.httpsResourceAccessor role to the allAuthenticatedUsers group on an IAP backend. Why does this not grant unrestricted access if an Access Context Manager access level is attached?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Our DevOps team needs to set up automatic 90-day rotation for GCP Service Account RSA key pairs and assign custom IAM roles to automated build pipelines using gcloud IAM commands. What Access Context Manager access levels should be bound to the service account keys?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 A network architect proposes setting up a regional OpenVPN server and restricting backend GKE ingress controllers solely to the VPN's internal IP range as our primary zero-trust solution. Why does BeyondCorp reject this approach and what replaces network perimeter trust?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We want to prevent employees from downloading sensitive PDF files or copying confidential data to personal USB drives in Google Chrome browser sessions on managed laptops. Which IAP IAM policy binding or Access Context Manager condition blocks clipboard copy operations in Chrome?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are migrating an internal App Engine and Compute Engine web service from a traditional corporate VPN model to Google Cloud's Zero Trust architecture. Our network team wants to deploy Cloud Armor IP rate limiting as the primary zero-trust access gate. What service should serve as the central enforcement point intercepting incoming application requests and evaluating contextual access, and which API must be enabled for it?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 What is the correct sequence of steps when implementing BeyondCorp Zero Trust protection for a fleet of internal web applications on GCP, starting from resource enablement through monitoring?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 At what point in the web request lifecycle does BeyondCorp evaluate Access Context Manager access levels for an incoming HTTP request directed to a protected App Engine service?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An infrastructure team is preparing to roll out BeyondCorp context-aware access for internal GCP web applications. What foundational licenses and GCP APIs must be active before deploying policy bindings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 A legacy app relies on client source IP whitelisting inside firewall rules for authorization. When transitioning to BeyondCorp, what replaces static IP whitelisting as the primary vector for request authorization?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We need to configure web application firewall (WAF) rules on our Google Cloud External HTTP(S) Load Balancer to mitigate HTTP flood attacks and block SQL injection attempts targeting our public website. How should we set up BeyondCorp IAP and Access Context Manager to block these OWASP Top 10 web attack vectors?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of +29 percentage points is the difference between those two pass rates over the 24 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 29.2%
Cases attempted: 24
Cases counted toward lift: 24
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 10:14 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run29

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.