Sure, BeyondCorp is what I was thinking of. And yes, there are a subset of devices that are managed and can be used to access higher levels of "security" but th

Sure, BeyondCorp is what I was thinking of. And yes, there are a subset of devices that are managed and can be used to access higher levels of "security" but these are deliberately limited so they can be managed closely. But the underlying point was that the default position is untrusted network, untrusted clients - even for the vast majority of clients that you would otherwise consider "managed" - eg classroom computers, laptop trolleys etc