Sure, BeyondCorp is what I was thinking of. And yes, there are a subset of devices that are managed and can be used to access higher levels of &quot;security&quot; but these are deliberately limited so they can be managed closely.<p>But the underlying point was that the default position is untrusted network, untrusted clients - even for the vast majority of clients that you would otherwise consider &quot;managed&quot; - eg classroom computers, laptop trolleys etc