# Blast radius (AI agents)

**Blast radius is the most harm one AI agent run can do if it goes wrong, measured in records changed, messages sent, money spent or destinations reached, and capped by limits set outside the model.**

*Part of the [Learn hub](https://privycdp.org/learn) and the [customer data glossary](https://privycdp.org/learn/glossary).*

## What it means in practice

Blast radius sizes a failure before it happens, and it has two parts: how much a run can touch and whether the result can be undone.

The idea comes from reliability engineering. AWS describes cell-based designs that limit a failure's scope: with 10 cells serving 100 requests, a failure leaves 90% of requests unaffected [1](#source-1).

On a [rail card](https://privycdp.org/learn/glossary/rail-card), blast radius sits in the Limits field: maximum records, maximum sends, budget, rate, time window and allowed destinations. A gateway or execution service holds these limits, because a limit inside a prompt is only a request.

The radius can grow in two ways. Agents acting in chains can cause what OWASP lists as cascading failures [2](#source-2), so set combined limits across rails. Effects can also land outside your systems: Amazon SES may review an account at a 5% bounce rate and may pause sending at 10% [3](#source-3). See [7 things AI agents should never do](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data).

PrivyCDP lets teams restrict what data its AI reaches, which narrows one part of the radius.

**Example (online retailer, illustrative):** the [Audience Sync Steward](https://privycdp.org/ai/rails/agents/audience-sync-steward) runs at L3. Its worst case is a wrong audience sent to one allow-listed destination, up to a maximum size, with a limit on syncs per day. Above a size threshold, a second approver must sign.

## Related terms

- [Rail level](https://privycdp.org/learn/glossary/rail-level): L4 needs a small, reversible radius.
- [Rail card](https://privycdp.org/learn/glossary/rail-card): the Limits field.
- [Kill switch](https://privycdp.org/learn/glossary/kill-switch): stops a run that has started.
- [Approval gate](https://privycdp.org/learn/glossary/approval-gate): adds a second approver at scale.

## Where it matters

- [The agent rail card](https://privycdp.org/ai/rails/agent-rail-card): how to write limits.
- [Marketing anomaly detection](https://privycdp.org/ai/rails/use-cases/campaign-anomaly-detection): a pause that contains a bad send.


Back to the [customer data glossary](https://privycdp.org/learn/glossary) or the [Learn hub](https://privycdp.org/learn).

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### How do you limit an agent's blast radius?

Cap records, sends, spend, rate and destinations in a system outside the model. No universal number exists, so start from the size of a normal run and the cost of one wrong action.

### Is blast radius the same as risk?

No. Risk also includes how likely a failure is. Blast radius assumes the failure has happened and asks how far it reaches, so you can bound it even when the likelihood is unknown.

## Sources

1. AWS Well-Architected Framework, bulkhead architectures: https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/rel_fault_isolation_use_bulkhead.html
2. OWASP Top 10 for Agentic Applications for 2026: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
3. Amazon SES, enforcement FAQ: https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html


## Further reading

- [Audience Sync Steward: An AI Agent for Approved Audience Syncs](https://privycdp.org/ai/rails/agents/audience-sync-steward)
- [AI Agents for Marketing Operations: The Playbook on Rails](https://privycdp.org/ai/rails/functions/marketing-operations)
- [Approval gate](https://privycdp.org/learn/glossary/approval-gate)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)