Free to read · no account needed

9 min · safety

Agent blast radius: how much can it hurt if wrong?

Goal: Estimate blast radius before granting any agent-like tool write, send, delete, or purchase rights.

Best for: Anyone about to allow tools that change the world outside the chat box.

Blast radius is how much damage a wrong or repeated action can do. Drafting in chat is low. Sending to 10,000 users is high. Match permissions to radius—not to how confident the model sounds.

Blast radius is everything a wrong click can touch. Shrink scopes, add pauses, and assume mistakes will happen.

Draw the radius on paper: which inboxes, drives, and calendars a wrong click could touch. If the circle scares you, shrink scopes before you add features.

Scene tip: Draw the blast circle before you grant the second write scope—not after the wrong invite sends.

Why beginners skip this

Opening full permissions at once feels easy—one misfire can sweep disks it should never touch. Shrink the radius before go.

Step 1 — Three questions

  • If this action runs twice by mistake, what breaks?
  • Who else is affected (customers, coworkers, students)?
  • Can I undo it in five minutes?

If undo is hard, permission must be hard.

Step 2 — Match permission to radius

Match permission to blast radius from this table; if radius is unclear, stay read-only.

Blast radiusExamplesPermission
LowDraft in chat; rewrite your bulletsAllow freely
MediumEdit a sandbox file; create a draft email you will reviewAllow once / Ask
HighSend/post/pay/delete/share externallyAsk every time; often “human sends”
Example

Filled prompt

Agent drafts + can create Drive docs in Shared folder.
Map 60-second blast if wrong folder. Ask-every-time on create. Kill-switch owner.

What good output looks like

  • Worst cases name mass-email and Drive overwrite in concrete terms
  • Mitigations: Ask-before-send, draft-only Gmail, read-mostly Drive
  • Disconnect order starts with Gmail send, then Drive write
  • No hand-wavy “be careful” as the only control
  • Fits on one page you can act on today without a security team

Step 3 — Write it down

Add a one-line Project rule: “Never send/post/pay without my explicit OK naming the audience.”

Example

Filled prompt

Agent can: read Drive, draft Gmail, create calendar invites.
Map blast radius: what it can ruin in 60 seconds if wrong.
Write: allow-list, ask-every-time list, kill-switch owner.
Scenario: wrong invite to external partner list.

What good output looks like

  • Six bullets you can finish today without a security team
  • Each bullet is a revoke, Ask toggle, or draft-only switch
  • Solo-friendly—no enterprise jargon required
  • Ends with a one-line Project rule against silent sends
  • Does not invent connectors you never mentioned

Save this card

Card: Match permission to blast radius—anything you cannot undo in five minutes stays closed at first. Keep this beside the tool; read before you start.

Before you start

Put the scrub checklist on your desk. For “Estimate impact before granting write, send, delete, or purc,” decide placeholders before the paste window opens Guide: safety-agent-blast-radius Keep the live artifact visible the whole time. If you only have a blank box, stop and fetch the real job first

How to use this week

This week draw a blast-radius map for a real agent: read / write / external each as a ring; any out-of-ring action needs human confirm.

Draw it once

Paper circle of inboxes/drives a wrong click can touch. Shrink until you can sleep.

Undo hard → permission hard

Drafting in chat is low radius. Sending to a list, paying, or deleting Drive files is high. High-radius actions stay on Ask every time—or human sends. Confidence in the reply does not shrink the radius.

Example

Filled prompt

Agent can create Shared Drive docs.
60s blast if wrong folder. Ask-every-time on create. Kill-switch owner named.
Context: real workstream this week (Asia/Shanghai). Name actual files/people.
Constraints: no invented metrics/owners/prices; label Unknowns; stop before send/delete/pay.
Done check: I can mark pass/fail in one minute on the output.

What good output looks like

  • No raw PII/secrets in the paste for “Estimate impact before granting write, send, delet”
  • Placeholders used; scrub checklist visible
  • Disclosure matches how much AI actually did
  • Pass/fail: desk card updated today

Red flag

Irreversible tools open on day one; undo > five minutes still enabled—close until gated.

Pitfalls

PitfallFix
Confidence ≠ low radiusJudge impact, not tone
Batch actions without dry runSandbox first
Shared agent credentialsSeparate accounts; least privilege
Example

Filled prompt

Temptation: skip the habit for safety-agent-blast-radius to save five minutes.
Job still: Estimate impact before granting write,
Smallest correct pass: Done visible · checkable artifact · Unknowns [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: artifact + refuse-line said aloud.

What good output looks like

  • Names the shortcut refused (specific to safety-agent-blast-radius)
  • Still delivers checkable output for “Estimate impact before granting write,”
  • Unknowns labeled; draft-only
  • Pass/fail: refuse-line dated (safety-agent-blast-radius #4)

Practice now

Read-only hour: first hour of agent use is read-only tools only (Asia/Shanghai).

Write-gate drill: every write action gets a named human approver (Asia/Shanghai).

Blast drill: list touchable systems; add human gate beside each write action (Asia/Shanghai).

Blast-radius drill: list systems an agent could touch; cut any without a human gate (Asia/Shanghai).

Thin-spot drill: rewrite the Save card with real nouns from your work (repo, doc, inbox). Generic placeholders fail the drill.

Tonight draw a blast-radius map for a real agent: read / write / external each as a ring; any out-of-ring action needs human confirm.

Buffer line: name the artifact path you used (Asia/Shanghai).

Close the loop

Write one line: next time I open full permissions at once, I refuse go.

One sentence takeaway

Draw the blast radius first; out-of-ring actions always need human confirm.

Next

Computer use safely · HITL checkpoints · MCP least privilege · Secrets and pasting

← Back to home · Learn · Tools · Compare · Start