Agents and the blast radius problem
Feb 27, 2026 · 8 min read
Autonomous agents make the cost of an unbounded action much higher. Here's how we think about scoping permissions for tool-using systems.
When a single LLM call could only generate text, the worst case was a bad answer. When that call can invoke a payment API, schedule a transfer, or modify a customer record, the worst case is a regulatory event.
This is the blast radius problem. Most agent frameworks ship with a tool registry that grants every tool to every agent by default. We argue this is the AI equivalent of running everything as root.
The correct primitive is purpose-scoped, identity-bound tool grants - evaluated at runtime, expressed as policy, and revocable in real time. We'll publish the interface design we've converged on with our enterprise design partners next month.
Further reading