INSTRUMENT | Propagation & containment
Agent Action Risk Matrix: Which Actions Need an Approval Gate
3 cited sources
Place every action your agent can take on two axes: whether anything undoes it, and its blast radius, the field's name for propagation radius. Each row returns a written control level, never a score.
Place every action your agent can take on two axes: whether anything undoes it, and how far its effects reach. That reach is blast radius, the field's name for propagation radius.
Read both off the design, before a run: which failure domain an action crosses. Propagation radius is measured after one, with propagation depth beside it. Built on how one fault spreads through an agent topology and the OWASP cheat sheet. Each row returns a control, never a score.
Showing your last valid result. Update the inputs above to recompute.
No action has a name yet, so there is nothing to place and nothing to export. Type an action into the first row and the grid below fills in.
The matrix
Rows are reversibility. Columns are blast radius, this site's propagation radius. Each cell shows the control the map gives it and the actions placed there. The count in a cell is a count of actions and nothing else.
| Reversibility | B0 One record, one session, one person's own workflow. | B1 One team, one internal system, one department process. | B2 The whole organization, or a business-critical or production system. | B3 Outside the organization. Customers, partners, the public, regulated populations. |
|---|---|---|---|---|
| R0 Changes no state. Reads, searches, scores, drafts with no outside effect. | R0 B0 C1 The agent may do it without approval. Log the call. Propose a refund 1 action | R0 B1 C1 The agent may do it without approval. Log the call. Read account details 1 action | R0 B2 C1 The agent may do it without approval. Log the call. 0 actions | R0 B3 C2 The agent may do it inside a written bound. Log it, review after. 0 actions |
| R1 The actor can undo it. Version history, a restorable delete, an idempotent re-apply. | R1 B0 C1 The agent may do it without approval. Log the call. 0 actions | R1 B1 C2 The agent may do it inside a written bound. Log it, review after. 0 actions | R1 B2 C2 The agent may do it inside a written bound. Log it, review after. 0 actions | R1 B3 C3 The agent may only prepare it. A named person approves the exact parameters before it runs. 0 actions |
| R2 A different, compensating operation reverses it, under business rules, and may not restore the original state. | R2 B0 C2 The agent may do it inside a written bound. Log it, review after. 0 actions | R2 B1 C2 The agent may do it inside a written bound. Log it, review after. 0 actions | R2 B2 C3 The agent may only prepare it. A named person approves the exact parameters before it runs. 0 actions | R2 B3 C3 The agent may only prepare it. A named person approves the exact parameters before it runs. Issue a refund (up to 500 dollars); Issue a refund (over 500 dollars) 2 actions |
| R3 Point of no return. Nothing undoes it. | R3 B0 C4 The agent may prepare and hand off. A person executes it where the agent cannot reach. 0 actions | R3 B1 C4 The agent may prepare and hand off. A person executes it where the agent cannot reach. 0 actions | R3 B2 C4 The agent may prepare and hand off. A person executes it where the agent cannot reach. 0 actions | R3 B3 C4 The agent may prepare and hand off. A person executes it where the agent cannot reach. 0 actions |
Every action, with its verdict
| Action | Levels | Effect | Control | What that means | Compensating action | Approver |
|---|---|---|---|---|---|---|
| Read account details | R0 B1 | does not apply, it changes no state | C1 | The agent may read account details. | does not apply, it changes no state | not recorded |
| Propose a refund | R0 B0 | does not apply, it changes no state | C1 | The agent may propose a refund. | does not apply, it changes no state | not recorded |
| Issue a refund (up to 500 dollars) | R2 B3 | destructive | C2 | The agent may issue a refund inside a stated bound: up to 500 dollars. Logged and reviewed after. | Post an offsetting charge, under the refund policy. | not recorded |
| Issue a refund (over 500 dollars) | R2 B3 | destructive | C3 | The agent may propose to issue a refund. A named approver approves the exact parameters before it runs. | Post an offsetting charge, under the refund policy. | not recorded |
What nothing undoes
No action on this sheet is a point of no return.
Gaps
- Duplicate action names: Issue a refund. Both rows are kept: splitting one action across two bounds is how a refund under 500 dollars and a refund over it get different controls.
Markdown is the document you paste into a design doc. JSON is the same document, plus an MCP tool-annotation block per row, and it loads back into this form.
The JSON this page exports, and only that. Read in this browser: nothing is uploaded, and nothing here is stored between visits.
JSON. Drag one here, or use the box below.
Check this value.
How this is decided
There is no formula. Two axes, both read off the design before anything runs, land each action in one of sixteen cells, and each cell carries a named control level. The map is printed below so you can disagree with any row of it.
Reversibility
- R0
- Changes no state. Reads, searches, scores, drafts with no outside effect.
- R1
- The actor can undo it. Version history, a restorable delete, an idempotent re-apply.
- R2
- A different, compensating operation reverses it, under business rules, and may not restore the original state.
- R3
- Point of no return. Nothing undoes it.
Blast radius, also called propagation radius
The two names are one idea. Blast radius is what the field says; propagation radius is this site's term and the one the measured version uses, with propagation depth as its counterpart. Here the question is design-time: which failure domain the effects cross if the action fires wrong. After a run, the same word describes how far a fault actually reached.
- B0
- One record, one session, one person's own workflow.
- B1
- One team, one internal system, one department process.
- B2
- The whole organization, or a business-critical or production system.
- B3
- Outside the organization. Customers, partners, the public, regulated populations.
The control map
| Reversibility | B0 | B1 | B2 | B3 |
|---|---|---|---|---|
| R0 | C1 | C1 | C1 | C2 |
| R1 | C1 | C2 | C2 | C3 |
| R2 | C2 | C2 | C3 | C3 |
| R3 | C4 | C4 | C4 | C4 |
- C1
- The agent may do it without approval. Log the call.
- C2
- The agent may do it inside a written bound. Log it, review after.
- C3
- The agent may only prepare it. A named person approves the exact parameters before it runs.
- C4
- The agent may prepare and hand off. A person executes it where the agent cannot reach.
Two rules keep this out of composite-score territory. The levels are never multiplied, added or averaged, and no list on this page is ordered by control level: C1 to C4 are labels. The map is policy, not measurement.
R0 escalates at B3 because a read that leaves the organization is a disclosure path. The R3 row is flat at C4 at every reach, because reach cannot make a point of no return reversible. If you judge a low-reach irreversible action safe at C3, set the level by hand and say why; the page keeps both answers.
Questions
Why is it called blast radius here and propagation radius everywhere else?
They name one idea, and the field says blast radius. This site's term is propagation radius, which is what a measured fault gets described by after a run. This page asks the same question of a design, before any run, so it uses the phrase you would say out loud and names the site's term beside it every time.
I set a row to R3 and typed how it is undone. Why is that flagged?
R3 means nothing undoes it. If something does, the row is R2. The page keeps what you wrote and lists the contradiction in Gaps rather than quietly moving the level, because the disagreement is the thing a design review needs to see.
Two rows have the same action name. Is that wrong?
No. Splitting one action across two bounds is how a refund under 500 dollars and a refund over it get different controls. The rows are noted as duplicates and both are kept.
What are the MCP fields in the JSON export?
Four per row, in the shape the Model Context Protocol tool format uses: read-only, destructive, idempotent and open-world. They are hints. The format itself says a client cannot assume they are faithful, and a system prompt that says to ask before deleting does not prevent a deletion. The destructive hint comes from the effect field you set, never from the reversibility level, because a restorable delete is still a delete.
Does refreshing keep my work?
No. Nothing here is stored between visits and nothing leaves your browser. Export the JSON to keep a sheet, and load it back the next time.
Can I add up the levels to compare two agents?
No, and the page gives you no total to try it with. The levels are names, not quantities: R2 is not twice R1, and a C4 row plus a C1 row is not a C5. Compare two agents by reading which actions land at C3 and C4 and what nothing undoes.