What is Blast Radius?
Governance & ControlThe maximum damage an agent can do if everything goes wrong: the scope of data, systems, and money its credentials can reach. Scoped down at design time, it is the difference between an incident and a headline.
Why It Matters
Blast radius is the question that decides whether an agent failure is a ticket or a postmortem the board reads about. The PocketOS incident is the illustration: a coding agent deleted a production volume in nine seconds because the token it held, issued for domain operations, carried the authority to delete production volumes. The agent did not exploit anything. It used a legitimate tool within a blast radius nobody had scoped down, and the post-incident analysis put the shape of the mistake plainly: authority appropriate to a senior engineer, controls appropriate to a chatbot, infrastructure designed for humans who type slowly and confirm twice.
What Sets the Radius
Credentials. Everything the agent’s tokens can reach: environments, resources, verbs. The radius is whatever the widest credential permits, not what the task needs.
Tool surface. The set of tools wired into the loop. A tool the agent can call is a tool inside the radius, whether or not the task ever uses it.
Spend. The budget the run can consume before something trips. An unbounded agent can do damage measured in invoices even when it never touches a destructive tool.
Where It Breaks
The radius is set by accumulation, not by decision. Credentials get issued broadly because scoping takes work, tools get added and never removed, and nobody computes the union until an incident does it for them. The subtler failure is assessing blast radius at the component level: each agent looks tightly scoped while the multi-agent system’s combined reach, through handoffs and shared credentials, is far wider than any single part.
How Flytebit Handles It
We compute blast radius explicitly during design: the union of credentials, tools, and spend each agent can reach, then scope each down to the task. PocketOS-class failures become structurally impossible because the credential for staging cannot name a production resource. The incident math is in Agentic AI Horror Stories, and the engagement version is our AI governance and risk work.