Loading patterns…
Blast-Radius Containment & Autonomy Bounds(BRC)
Bounds the worst-case impact of a misfiring agent before it acts, rather than only detecting misuse after the fact. Tools are classified by reversibility and impact (read is free, write is validated, destructive is paused); authority is scoped least-privilege per task; autonomy is graduated (from assist, to propose-and-approve, to act-and-audit, to observe) and earned as reliability is proven; irreversible steps surface a dry-run or plan-preview so a human reviews the plan and not the aftermath; and a kill switch with state capture and quarantine can halt the agent mid-run. Distinct from human-in-the-loop: that is an oversight stance, while this bounds capability by reversibility. Distinct from agent-sandboxing: that isolates the execution environment, whereas this tiers per-tool reversibility and graduates autonomy. Distinct from tool-misuse-prevention: that defends against injection-driven misuse, not blast-radius classification.
In 30 seconds
- What
- Classifies tools by reversibility (read, write, destructive), grants least-privilege per task, graduates autonomy as reliability proves, and surfaces irreversible actions for dry-run review before execution.
- When to use
- High-stakes systems where agent mistakes cause real damage (databases, infrastructure, payments) and you need to bound worst-case impact before the agent acts.
- Watch out
- Overhead of classifying every tool and managing graduated autonomy levels can slow deployment; false confidence in reversibility classification leads to missed blast radius.
Ask the AI expert about this pattern
Opens the assistant with your question prefilled. You review it before sending.
Blast-Radius Containment & Autonomy Bounds: Overview
Bounds the worst-case impact of a misfiring agent before it acts, rather than only detecting misuse after the fact. Tools are classified by reversibility and impact (read is free, write is validated, destructive is paused); authority is scoped least-privilege per task; autonomy is graduated (from assist, to propose-and-approve, to act-and-audit, to observe) and earned as reliability is proven; irreversible steps surface a dry-run or plan-preview so a human reviews the plan and not the aftermath; and a kill switch with state capture and quarantine can halt the agent mid-run. Distinct from human-in-the-loop: that is an oversight stance, while this bounds capability by reversibility. Distinct from agent-sandboxing: that isolates the execution environment, whereas this tiers per-tool reversibility and graduates autonomy. Distinct from tool-misuse-prevention: that defends against injection-driven misuse, not blast-radius classification.
- Tools classified by reversibility and impact (read free, write validated, destructive paused)
- Least-privilege tool scoping granted per task
- Graduated autonomy levels earned as reliability is proven
- Dry-run and plan-preview before irreversible actions
- Kill switch with state capture and quarantine
- Worst-case impact bounded before the agent acts, not after
The Agent Architect
One pattern, one tradeoff, one production failure story. A short weekly briefing for people building agentic systems.
Weekly email, one-click unsubscribe. We only use your address to send the briefing.
References
The papers, specifications, and repositories this pattern is based on.
From the engineer behind this catalog
Get your agent system red-teamed
The controls described here only hold if somebody tries to break them. Have yours tested the way a real attacker would: prompt injection, jailbreaks, tool misuse and data exfiltration, every finding written up next to its fix.
€750 instead of €1,500, one week, written report and walkthrough call, until 30 September