Pattern matrix/White paper/G2

Blast-Radius Control assumes that approval, models, and tools will fail and defines how many resources, how much budget, and how much downstream propagation one error may cause.

Coordinate and boundary

Governance × Hierarchy. Identity bounds capability, capability bounds resources, and resources remain inside quantity, rate, time, cost, concurrency, and network limits. Layers add value only when credentials, processes, and configuration paths are genuinely independent.

Hard and autonomy envelopes

effective_scope = intersect(
    hard_envelope,
    principal_scope,
    task_scope,
    capability_scope,
    current_context_scope,
    evidence_based_scope
)

Delegation may preserve or narrow scope, never widen it.

Aggregate dimensions

Quantity, rate, cost, and concurrency cannot be measured only per tool. Ten child agents below a local cap can still break the run total. Aggregate at the appropriate action, run, principal, tenant, and fleet levels.

Running example

An approved 18-person payroll batch remains limited to one tenant, 20 rows per action, 40 per run, one concurrent write, the intent amount ceiling, and a harder infrastructure ceiling. A duplicate retry meets both idempotency and run-level limits; another tenant fails resource scope.

Multi-agent execution

A central orchestrator can aggregate directly. Choreography requires shared run, principal, delegation, and remaining-budget references. Local limits expand under fan-out, retry, and loops, so child count, delegation depth, and cross-domain propagation also need caps.

Failure and verification

Common failures include treating sandboxing as the business boundary, replacing aggregate limits with per-tool limits, allowing the agent to change hard limits, sharing authority with the kill switch, bypassing controls on retry and resume, and discovering an irreversible violation only after execution.

Inject faults to measure worst-case objects, amount, cost, and propagation. Exercise stop latency, aggregation under retry and fan-out, and the agent's inability to modify limiters, breakers, and evidence.