Removed: the privileged corporate network, and the VPN staff used to reach it.
Outcome: no network position grants trust. Every request is authorised against the user’s credentials and the state of their device.
Google ran that experiment a decade before the memo: BeyondCorp deleted the privileged corporate network outright — no more “inside the building, therefore trusted”, no VPN to get there, just per-request authorisation against the user’s credentials and the state of their device.
The flat intranet everyone trusted was the largest single standing permission grant in the company, and removing it was the point.
Source: Rory Ward and Betsy Beyer, BeyondCorp: A New Approach to Enterprise Security, ;login: (December 2014)